24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 53:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4da,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILHeracles.Generic Sample 913088dfb9d0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 913088dfb9d0…. Malware family: MSILHeracles.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 19 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","keywords":["Malicious","MSILHeracles.Generic","malware analysis","sandbox report","threat intelligence","913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6"],"about":{"@type":"SoftwareApplication","name":"HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr","applicationCategory":["peexe","assembly","executable"],"identifier":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILHeracles.Generic","antivirusDetections":{"malicious":16,"total":24},"behavioralIndicators":{"malicious":19,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8a2,Found reference string "Policy Bypass Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\913088dfb9" (Indicator: "add-mppreference"; Source: "00000000-00003112-00000C47-18094272818") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '913088dfb9" (Indicator: "add-mppreference"; Source: "00000000-00003112-00000C47-35792627118") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPU" (Indicator: "add-mppreference"; Source: "00000000-00003112-00000C47-53869898424") Found reference string ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.ex" (Indicator: "add-mppreference"; Source: "00000000-00003112-00000C47-74055284156") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\XClient.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '" (Indicator: "add-mppreference"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference string "ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '" (Indicator: "add-mppreference"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp")26:T1944,Found reference to "n5tYnEHApx6lZmMWMpwceRC2c1RsSHIOxYkSU7TLtXaO" (Indicator: "RC2"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to "O2b4tXDfq1ZH2pu4KwRrNEx9GOidEeMS0DU6qgJ6T2pT" (Indicator: "Oid"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp")27:T5df,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER")28:Te9b,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00002720-00000105-5182551 [PID: 2720] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00002720-00000105-5182881 [PID: 2720] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00002720-00000105-5244974 [PID: 2720] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-43348805 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-45942890 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-45943418 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-46068481 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-46071005 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-46071286 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-46191919 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-76157603 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-76158905 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-76327935 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-106293255 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-106293956 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-106432819 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-136397815 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-136398151 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-136568588 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-166533753 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-166534090 [PID: 3112] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queried SystemProcessInformation at 00000000-00003112-00000105-166689082 [PID: 3112] "powershell.exe" queried SystemProcessInformation at 00000000-00002288-00000105-2294973 [PID: 2288] "powershell.exe" queried SystemProcessInformation at 00000000-00002288-00000105-2455612 [PID: 2288] "powershell.exe" queried SystemProcessInformation at 00000000-00002288-00000105-3791663 [PID: 2288]29:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}2a:T5a5,Assembly shows XOR instruction xor dl byte ptr [eax+1A2A01A6h] in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor eax dword ptr [ebp+02h] in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor eax 1A2A7000h in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor dword ptr [ecx] eax in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00003112-48867-1-004137EE Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00003112-48867-13-00405DE4 Assembly shows XOR instruction xor al 25h in Stream UID: 00000000-00003112-48867-13-00405DE4 Assembly shows XOR instruction xor bh byte ptr [ebx] in Stream UID: 00000000-00003112-48867-13-00405DE42b:T4c8,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - Customized RC4 encryption for MSIL Matched sigs: YARA signature match - AES encryption2c:Tdb6,Found XOR loop in file "XClient.exe" at offset 17300; code bytes = 30d0 Found XOR loop in file "XClient.exe" at offset 68198; code bytes = 30d0 Found XOR loop in file "XClient.exe" at offset 78579; code bytes = 30d0 Found XOR loop in file "XClient.exe" at offset 90134; code bytes = 30d0 Found XOR loop in file "XClient.exe" at offset 371852; code bytes = 30d0 Found XOR loop in file "XClient.exe" at offset 480540; code bytes = 30d0 Found XOR loop in file "XClient.exe" at offset 94184; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 106306; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 144647; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 281852; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 330775; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 331174; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 345637; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 402429; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 414852; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 436777; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 443744; code bytes = 33c1 Found XOR loop in file "XClient.exe" at offset 5464; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 16546; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 172890; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 245732; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 311686; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 442943; code bytes = 8030 Found XOR loop in file "XClient.exe" at offset 499932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 17300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 68198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 78579; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 90134; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 371852; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 480540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 94184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 106306; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 144647; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 281852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 330775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 331174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 345637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 402429; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 414852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 436777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 443744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 16546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 172890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 245732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 442943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 499932; code bytes = 80302d:T80e,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000014000000000000000000000000000000000000000000000002000002c0bb2a00500000500000000000000000000000008000000000000000296c004568592b000100000000000000020000000c000000987a2a00987a2a00937a2a000000000000000000000026000000000188ef180000000000a8f5180095e1b8774e2a6b00feffffff435cbc775059bc7794000000a0000000927a2a00907a2a00940000002cf11800fdfe2d770cea180001000000a8f5180092e0486b92918dcffeffffffc4f018004c9c486b5c0c0000d8f018005f9c486b0000000000000000 (UID: 00000000-00002720)2e:T1fd8,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000001000000010000000000000000000000300064006300650000000000000000000000000000000000010000002f0000000000000000000000630034003800350034003800350033006200620000000000000064000000000000000000000000000000000000000000 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6bc77f2d0cf77f42e3472c0482a00a035347202d0cf77bce81800b0212a00b2f4bc7712d0cf77cce8180000002d7200002d720000000028e81800f0000000f0002d720000000038e8180053000000cce9180000000000010000009ce8180040f5bc77000000000000000088e81800 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c477174387532008c4771740000000038753200ccdb1800086dbc771881c4770000000080dc180000000000de5426650cdc180095e1b877a6296b00feffffff6b2cbd773119ce75021000000000000000000100e0db1800c89fbc778c4771740000000000000000 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c00530020cd570011000011011500003080580098d2570098b05800c4b05800f0b058001cb1580048b1580074b15800a0b15800ccb158000b00000b1215000040b0580098d257006f00630061006c005c00500072006f0067007200 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebbb76981f5f0000d0fd7f9a5cbd7700f0fd7fb4bb2a0044d0fd7f00000000400000003f0000002b00000000d0fd7fa8bb2a00c15cbd776082c4772b00000000d0fd7f9a5cbd7700f0fd7fccbb2a005789bc778083c4771317ce75d8ebbb76 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a076c08000000c41a076cbf24002302000000d41c076c00002b00e616076cd09bc700c09bc700e0d72a00d0f0086ca0d82a0053af086c63e62d4ffeffffffc41a076c421a076ce616076c34d82a00d91b076ce616076c67c18f77ae05d1757457d1750000000000000000cc92cd75 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a076c08000000c41a076cbf24002302000000d41c076c00002b00020000000000000088000000e0d72a0020d82a00459d8f770000c70000000000800000000200000000002b0098130e6c34d82a00 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6bc77a6870c73f42e3472f0bc5004a035347296870c7324f0db04e0215700b2f4bc7786870c7334f0db0400002d7200002d720000000090efdb04f0000000f0002d7200000000a0efdb045300000034f1db04000000000100000004f0db0440f5bc770000000000000000f0efdb04 (UID: 00000000-00003112) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000240000000200000000000000000000008a8b3b001100000000000000000000002200000000000000000000000f00010ee5ac000e63006f006e00660069006700750072006100740069006f006e0000005c00500072006f006700720061006d0073005c0050007900740068006f006e00 (UID: 00000000-00002288) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e1b8777f8e6c00fefffffff5f6bc77634dbd77e82a3a001015836d88088300b2f4bc776b6a6c7754edbc000000826d0000826d804dbd778f6b6c77f0000000f000826d00000000c0ecbc005c00430054eebc00000000000100000024edbc0040f5bc77000000000000000010edbc00 (UID: 00000000-00002288) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006bc0ecbc0001000000000000000000e27600000000acecbc00000000000000000000000000c0ecbc00000000000000000000000000283662dfb4ecbc000300000000000000880000000000e276c0ecbc00459d8f77000070000000000080000000020000000000bd00dc1a826dd4ecbc00 (UID: 00000000-00002288) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002288) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebbb7600b945000060fd7f9a5cbd7700f0fa7fd8d5ff044460fd7f00000000400000003f000000250000000060fd7fccd5ff04c15cbd776082c477250000000060fd7f9a5cbd7700f0fa7ff0d5ff045789bc778083c4771317ce75d8ebbb76 (UID: 00000000-00002288) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000001000000640014000000388b3b00000000000100000001000000000000002c00000058303c0000000000140000000a000000000000000000000000006c00188f3c00140000000000000000000000000000000000000000000000001d000000000000285a3b0005000005 (UID: 00000000-00002116) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e1b87752ad6c00fefffffff5f6bc77634dbd77681e3b001015bd6c8808bd00b2f4bc77164cad7704ea7d000000bc6c0000bc6c804dbd77724cad77f0000000f000bc6c0000000070e97d005c00430004eb7d000000000001000000d4e97d0040f5bc770000000000000000c0e97d00 (UID: 00000000-00002116) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006b70e97d0001000000000000000000e276000000005ce97d0000000000000000000000000070e97d000000000000000000000000002cc1948e64e97d000300000000000000880000000000e27670e97d00459d8f770000800000000000800000000200000000007e00dc1abc6c84e97d00 (UID: 00000000-00002116) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002116)2f:T1314,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries volume information of "C:\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" at 00000000-00002720-0000010C-3780561 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries volume information of "C:\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" at 00000000-00003112-0000010C-2832459 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003112-0000010C-40802678 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\XClient.exe" at 00000000-00003112-0000010C-41869569 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002288-0000010C-2512695 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002288-0000010C-3092159 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002288-0000010C-3568594 "powershell.exe" queries volume information of "C:\share" at 00000000-00002288-0000010C-3570360 "powershell.exe" queries volume information of "C:\share" at 00000000-00002288-0000010C-3649342 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00002288-0000010C-4540657 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll" at 00000000-00002288-0000010C-4547885 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll" at 00000000-00002288-0000010C-4551530 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll" at 00000000-00002288-0000010C-4555169 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll" at 00000000-00002288-0000010C-4558684 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll" at 00000000-00002288-0000010C-4793913 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll" at 00000000-00002288-0000010C-4915324 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" at 00000000-00002288-0000010C-6523338 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll" at 00000000-00002288-0000010C-6529224 "powershell.exe" queries volume information of "C:\Program Files\AutoIt3\AutoItX\AutoItX3.PowerShell.dll" at 00000000-00002288-0000010C-6569249 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002116-0000010C-2591261 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002116-0000010C-3078924 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002116-0000010C-3681624 "powershell.exe" queries volume information of "C:\share" at 00000000-00002116-0000010C-3683256 "powershell.exe" queries volume information of "C:\share" at 00000000-00002116-0000010C-3773880 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00002116-0000010C-470108530:T426,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\913088DFB9D020B0D590B474CB80DCEC701EEDC7494A0A4C4854853BB21FD2C6.EXE") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\913088DFB9D020B0D590B474CB80DCEC701EEDC7494A0A4C4854853BB21FD2C6.EXE")31:T5a7,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")32:T698,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003112) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002288) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002288) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002116) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002116) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003176) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003176) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002936) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002936)33:T506,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateProcessA" with parameter "C:\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" - (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\913088dfb9" - (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '913088dfb9" - (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\HAPU" - (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.ex" - (UID: 00000000-00003112)34:T13563,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003112) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003112) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002288) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003176) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002936) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002936)35:T424,"select * from Bairro" (Source: 00000000-00002720.00000000.83179.01F40000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp, Indicator: "select * from bairro") "insert into Bairro (Nome) values (@nome)" (Source: 00000000-00002720.00000000.83179.01F40000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp, Indicator: "insert into bairro (nome) values (@nome)"), "update Bairro set Nome = @nome where Id = @id" (Source: 00000000-00002720.00000000.83179.01F40000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp, Indicator: "update bairro set nome = @nome where id = @id"), "delete from Bairro where Id = @id" (Source: 00000000-00002720.00000000.83179.01F40000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp, Indicator: "delete from bairro where id = @id"), "select * from Bairro where Nome like '" (Source: 00000000-00002720.00000000.83179.01F40000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp, Indicator: "select * from bairro where nome like '")36:T26e8,Found reference to API (Indicator: "CloseHandle"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "IsDebuggerPresent"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "OutputDebugString"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "DrawText"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "IsChild"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "GetCurrentProcess"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "Sleep"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "GetProcessById"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "GetObject"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "MessageBox"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetModuleHandle"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetTempFileName"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetKeyboardState"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "SetThreadExecutionState"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetKeyState"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "CompareString"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetTempPath"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetLastInputInfo"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetKeyboardLayout"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetWindowText"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "GetForegroundWindow"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "ToUnicodeEx"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "SetWindowsHookEx"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "CallNextHookEx"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "MapVirtualKey"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "CreateDirectory"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00002720.00000000.83179.00260000.00000004.mdmp, 00000000-00002720.00000000.83179.01F40000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugString"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp") Found reference to API (Indicator: "DrawText"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.00530000.00000004.mdmp, 00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.00530000.00000004.mdmp, 00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.00530000.00000004.mdmp, 00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002720.00000001.83674.00A10000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002720.00000001.83674.00A10000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp")37:T438,"Software\" in Source: 00003112.00000C28.12372556.00402000.wprm "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000001.83674.00260000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000001.83674.00260000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002720.00000001.83674.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002720.00000001.83674.00260000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002720.00000001.83674.01F40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002720.00000001.83674.01F40000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00002720.00000001.83674.01F40000.00000004.mdmp38:T462,Process 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe created mutex with name "\Sessions\1\BaseNamedObjects\f8RKHn3SOlVxjC9t" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"39:T19a1,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "C:\ntdll.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]3a:Td05,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002720.00000001.83674.00260000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002720.00000001.83674.00260000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002720.00000001.83674.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002720.00000001.83674.00260000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002720.00000001.83674.01F40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002720.00000001.83674.01F40000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00002720.00000001.83674.01F40000.00000004.mdmp "Software\" in Source: 00000000-00003112.00000000.83974.01F40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003112.00000000.83974.01F40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003112.00000000.83974.01F40000.00000004.mdmp "Software\3113BFFBC90745CAE806" in Source: 00000000-00003112.00000000.83974.01F40000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32" in Source: 00000000-00003112.00000001.85899.00530000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003112.00000001.85899.00530000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003112.00000001.85899.00530000.00000004.mdmp "Software\" in Source: 00000000-00003112.00000001.85899.01F40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003112.00000001.85899.01F40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003112.00000001.85899.01F40000.00000004.mdmp "Software\3113BFFBC90745CAE806" in Source: 00000000-00003112.00000001.85899.01F40000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32" in Source: 00000000-00003112.00000002.87819.00530000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003112.00000002.87819.00530000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003112.00000002.87819.00530000.00000004.mdmp "Software\" in Source: 00000000-00003112.00000002.87819.01F40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003112.00000002.87819.01F40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003112.00000002.87819.01F40000.00000004.mdmp "Software\3113BFFBC90745CAE806" in Source: 00000000-00003112.00000002.87819.01F40000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00003112.00000002.87819.01F40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00003112.00000002.87819.01F40000.00000004.mdmp3b:T6754,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 711a0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "KERNEL32" at base 77290000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "ADVAPI32.DLL" at base 75db0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c110000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "SHLWAPI.DLL" at base 76b10000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "VERSION.DLL" at base 74f10000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 65170000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "USER32.DLL" at base 76f70000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "MSCOREE.DLL" at base 6c1a0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "PSAPI.DLL" at base 76b70000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "RPCRT4.DLL" at base 76d70000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "KERNEL32.DLL" at base 77290000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63d60000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "OLE32.DLL" at base 77110000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "CRYPTBASE.DLL" at base 75970000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74740000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73a00000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6ae30000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63300000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "NTDLL.DLL" at base 77b70000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 73a20000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 65950000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62490000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "UXTHEME.DLL" at base 74740000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61c70000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 61b60000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 613e0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "SHELL32.DLL" at base 75ec0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77270000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "PROFAPI.DLL" at base 75a80000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "BCRYPT.DLL" at base 75590000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "CRYPTSP.DLL" at base 75480000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75210000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "IMM32.DLL" at base 76e20000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "COMCTL32.DLL" at base 722d0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "GDI32.DLL" at base 77cd0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 611f0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "GDIPLUS.DLL" at base 745a0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 745a0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77290000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75ca0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "URLMON.DLL" at base 77a20000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75c30000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "SECUR32.DLL" at base 757b0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71d60000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "OLEAUT32.DLL" at base 76e40000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "WINDOWSCODECS.DLL" at base 73f40000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "NTDLL" at base 77b70000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75920000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77270000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "RPCRTREMOTE.DLL" at base 75a10000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 65350000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63f40000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73a30000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b4d0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 634e0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62cc0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 62ad0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "SSPICLI.DLL" at base 75900000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6ed70000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "PROPSYS.DLL" at base 74830000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "COMCTL32.DLL" at base 74970000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "APPHELP.DLL" at base 75920000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "CLBCATQ.DLL" at base 76ee0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a070000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "SETUPAPI.DLL" at base 76bd0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74830000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "NTMARTA.DLL" at base 74ee0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77a20000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "SXS.DLL" at base 75980000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 6c0e0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75ec0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6eeb0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "LINKINFO.DLL" at base 6eea0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "NTSHRUI.DLL" at base 72420000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "SRVCLI.DLL" at base 75670000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "CSCAPI.DLL" at base 70d80000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "SLC.DLL" at base 73e80000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6adf0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 69200000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6c920000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 62350000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "WS2_32.DLL" at base 75e80000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75440000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74fa0000 "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75430000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76b10000 "powershell.exe" loaded module "VERSION.DLL" at base 74f10000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 711a0000 "powershell.exe" loaded module "KERNEL32" at base 77290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 65350000 "powershell.exe" loaded module "USER32.DLL" at base 76f70000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6c1a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 76b70000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76d70000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77290000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6c1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63f40000 "powershell.exe" loaded module "OLE32.DLL" at base 77110000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75970000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76e40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 634e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62cc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6b3c0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 75480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75210000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75db0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 60fe0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77b70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6ed70000 "powershell.exe" loaded module "SHELL32.DLL" at base 75ec0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 75c70000 "powershell.exe" loaded module "MSISIP.DLL" at base 73a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75aa0000 "powershell.exe" loaded module "IMM32.DLL" at base 76e20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6d820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 739e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 607c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 60460000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5fce0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 6ae70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 5fbb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73a30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b4d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6bb90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6adf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6b370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 5faa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 68a40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5fa50000 "powershell.exe" loaded module "SECUR32.DLL" at base 757b0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 5f8b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74740000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77270000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 75a10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 5f820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5f640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6c0e0000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75ca0000 "powershell.exe" loaded module "URLMON.DLL" at base 77a20000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75c30000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71d60000 "powershell.exe" loaded module "NCRYPT.DLL" at base 755b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75150000 "powershell.exe" loaded module "USERENV.DLL" at base 75c10000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77270000 "powershell.exe" loaded module "GPAPI.DLL" at base 75050000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77270000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77270000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 719b0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 719b0000 "powershell.exe" loaded module "PROFAPI.DLL" at base 75a80000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6c0d0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77270000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75aa0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5f530000 "powershell.exe" loaded module "GDI32.DLL" at base 77cd0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 75590000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6af10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5f4f0000 "powershell.exe" loaded module "MSISIP.DLL" at base 73a20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6cbc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 73a00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 622b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 61f50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 617d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 6ade0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 616a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6b3f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6bb70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6b3a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 615e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 68ab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 614d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 61330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 612a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 610c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6c070000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6d540000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5f260000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5f530000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 61a90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 62770000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 61310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 62640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 62580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 68ab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 62470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 62420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 61170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 62390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 5f190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6c0d0000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6bf50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5f080000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6afd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5d880000 "powershell.exe" loaded module "MSISIP.DLL" at base 739e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 71510000 "powershell.exe" loaded module "SENSAPI.DLL" at base 73a00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 60f100003c:T1533,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")3d:T947,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "XClient.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3e:T607,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA")3f:T101d,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002720-00000C2B-304576030] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002720-00000C2B-304920644] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002720-00000C2B-306083255] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002720-00000C2B-306231254] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002720-00000C2B-306487603] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002720-00000C2B-306559247] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002720-00000C2B-306699897] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002720-00000C2B-307052667] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002720-00000C2B-307400294] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002720-00000C2B-307768203] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002720-00000C2B-308027433] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00002720-00000C2B-308174189] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002720-00000C2B-308271003] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00002720-00000C2B-308355672] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002720-00000C2B-308578019] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002720-00000C2B-308647585] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002720-00000C2B-308728761] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002720-00000C2B-309142557] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00002720-00000C2B-309912341] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00002720-00000C2B-310119820] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002720-00000C2B-310923670] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002720-00000C2B-311007461] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00002720-00000C2B-311103785] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" [Source: 00000000-00002720-00000C2B-311525607] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003112-00000C2B-319900814]40:Tc3b,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "")41:T533,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries basic process information of the "C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll" (UID: 2720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries basic process information of the "C:\Windows\System32\cryptsp.dll" (UID: 2720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries basic process information of the "C:\Windows\Fonts\segoeui.ttf" (UID: 2720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries basic process information of the "C:\Windows\Fonts\verdanaz.ttf" (UID: 2720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries basic process information of the "C:\Windows\System32\secur32.dll" (UID: 2720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" queries basic process information of the "C:\Windows\System32\WindowsCodecs.dll" (UID: 2720) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppLocker\AppLocker.psd1" (UID: 2116) "powershell.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll" (UID: 3176)42:Tfdf,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "913088DFB9D020B0D590B474CB80DCEC701EEDC7494A0A4C4854853BB21FD2C6"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")43:T6e5,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"44:Tcfc,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\FLTLIB.DLL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\MSVCP140.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\VCRUNTIME140.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\ucrtbase.DLL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"45:Tcf7,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\FLTLIB.DLL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\MSVCP140.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\ucrtbase.DLL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"46:T9a7,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe.config" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\XxmE\" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.INI" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe.Local\" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll:Zone.Identifier" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\913088DFB9D020B0D590B474CB80DCEC701EEDC7494A0A4C4854853BB21FD2C6.EXE.CONFIG" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\XXME" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\913088DFB9D020B0D590B474CB80DCEC701EEDC7494A0A4C4854853BB21FD2C6.INI" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" trying to access non-existent file "C:\913088DFB9D020B0D590B474CB80DCEC701EEDC7494A0A4C4854853BB21FD2C6.EXE.LOCAL"47:T6c3,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" writes file "c:\users\%osuser%\appdata\roaming\xclient.exe" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\startup\xclient.lnk" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" writes file "c:\users\%osuser%\appdata\local\temp\log.tmp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\ez4fblwf.2bs.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\pgwfrw2s.pwx.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\jddafht4.my3.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\dlwc3mcr.3w0.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\r50qvshv.mfk.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\5qsssf50.ky2.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\s4qwzyqu.rxm.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\1gbsjhr2.hem.psm1" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" writes file "%appdata%\xclient.exe" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" writes file "%appdata%\microsoft\windows\start menu\programs\startup\xclient.lnk" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" writes file "%temp%\log.tmp"48:Teac,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00002720) "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002720)49:T535,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "00003112.00000C28.12372556.00402000.wprm") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00002720.00000001.83674.01F40000.00000004.mdmp")4a:Te7c,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANSERVER\DEFAULTSECURITY"; Key: "SRVSVCDEFAULTSHAREINFO"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")4b:T468,Found string "CloseHandle" (Source: 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6, API is part of module: KERNELBASE.DLL) Found string "IsDebuggerPresent" (Source: 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6, API is part of module: KERNELBASE.DLL) Found string "NtQueryInformationProcess" (Source: 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6, API is part of module: NTDLL.DLL) Found string "Rectangle" (Source: 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6, API is part of module: GDI32.DLL) Found string "DrawFrame" (Source: 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6, API is part of module: USER32.DLL) Found string "IsChild" (Source: 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6, API is part of module: USER32.DLL) Found string "GetCurrentProcess" (Source: 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6, API is part of module: KERNELBASE.DLL) Found string "Sleep" (Source: 913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6, API is part of module: KERNELBASE.DLL)4c:T444,"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\desktop.ini" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini"4d:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")4e:Tf15,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003580-00000C28-1363066120] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003580-00000C25-1517070708] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003580-00000C25-1517163836] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003580-00000C25-1517216363] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003580-00000C25-1517306599] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003580-00000C25-1517335856] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003580-00000C25-1517389261] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003580-00000C25-1517519739] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003580-00000C25-1517928225] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00003580-00000C25-1518153599] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003580-00000C25-1518252165] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003580-00000C25-1518370120] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003580-00000C25-1518496912] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003580-00000C25-1518824917] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003580-00000C25-1518931502] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003580-00000C25-1519041075] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003580-00000C25-1519064494] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003580-00000C25-1519112253] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003580-00000C25-1519426521] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003580-00000C25-1520010514] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003580-00000C25-1520034569] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003580-00000C25-1520060981] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" [Source: 00000000-00003580-00000C25-1520662365] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005548-00000C25-1523164271] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005548-00000C25-1569392047]4f:T9555,Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000660.00000000.162981.03090000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00000660.00000000.162981.03090000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;cfle" - Source: "00000000-00000660.00000000.162981.0317D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000660.00000000.162981.03350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000660.00000000.162981.03350000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0db/rdb/r(db/rtiu" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000660.00000000.162981.716E1000.00000020.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002716.00000000.161523.007AD000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002716.00000000.161523.007AD000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002716.00000000.161523.007AD000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002716.00000000.161523.02AB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002716.00000000.161523.02AB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcthawte," - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0l*,rl*,rl*,rl*,rpaew" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002716.00000000.161523.06CF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003580.00000000.161007.029F0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreporticrosoft\windows" - Source: "00000000-00003580.00000000.161007.04800000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\hbltsncnc17066_arrivalnotice_-wanhai271s216.scr.exe.configfile:///c:/hbltsncnc17066_arrivalnotice_-wanhai271s216.scr.exec:/hbltsncnc17066_arrivalnotice_-wanhai271s216.scr.exec:\hbltsncnc17066_arrivalnotice_-wanhai271s216.scr.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configwindows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\path2path1windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharewindows\microsoft.net\framework\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00003580.00000000.161007.04B40000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003580.00000000.161007.04B40000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003580.00000000.161007.04B40000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json08/08" - Source: "00000000-00003580.00000000.161007.07010000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,008/08" - Source: "00000000-00003580.00000000.161007.07010000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00003580.00000000.161007.71FF1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00003580.00000000.161007.71FF1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00003580.00000000.161007.71FF1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003580.00000000.161007.72091000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005548.00000000.161440.03100000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00005548.00000000.161440.04DB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005548.00000001.163362.03100000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00005548.00000001.163362.04DB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005548.00000002.165279.03100000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00005548.00000002.165279.04DB0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005548.00000002.165279.087E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006324.00000000.163653.02B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micrv_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006324.00000000.163653.02B40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006324.00000000.163653.02C2C000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006324.00000000.163653.02C2C000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00006324.00000000.163653.02C2C000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006324.00000000.163653.02DD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006324.00000000.163653.02DD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006324.00000000.163653.02DD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;geotrust" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?geotrust" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>0rtu).y0rjy0rcy0rqx0rax0rpx0raw0rw0r" - Source: "00000000-00006324.00000000.163653.071A0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006324.00000000.163653.716C1000.00000020.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007312.00000000.162323.00570000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007312.00000000.162323.00570000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007312.00000000.162323.00570000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007312.00000000.162323.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007312.00000000.162323.0089E000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007312.00000000.162323.0089E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcs=(6d(6z@(7r" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.o(6" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007312.00000000.162323.06CB0000.00000004.mdmp")50:Td14,"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003580) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003580)51:T6eb,Found reference to API "11478447514,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.406",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found reference to API "11482175858,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.421",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found reference to API "11247043628,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.312",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found reference to API "11249267330,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.312",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found reference to API "11246054554,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.312",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found reference to API "11242040630,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.312",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found reference to API "11244333492,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.312",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found reference to API "11481217858,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.421",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp") Found reference to API "11242832882,5888,3125,,GetDriveTypeW,kernel32.dll,"00:42:26.312",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00000660.00000000.162981.078F0000.00000004.mdmp")52:T547,"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" wrote 00000004 bytes to a remote process "C:\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" (Handle: 1468) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" wrote 00000004 bytes to a remote process "C:\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" (Handle: 1472) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" wrote 00000200 bytes to a remote process "C:\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" (Handle: 1472) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" wrote 00011800 bytes to a remote process "C:\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" (Handle: 1472) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" wrote 00000600 bytes to a remote process "C:\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" (Handle: 1472) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1396) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1412) "HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1268)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791862899535,"unified_at":"2026-10-13T03:41:39.535Z","metadata":{"hashes":{"sha256":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","sha1":"b279806541f457da98a8cc5c28d99a2c6847a865","md5":"c779cc1fe825364c13ae5f33117eb5cd","sha512":"67375326422871ed3e60d01cea86dc8d4d625749e76c32e1d84f416298a979637c1590a7d0c09ed082f16bc451f6e6db12fba01467c0ca115142b81a750038cc","ssdeep":"12288:1O/WtWzhKLwODOngkIcYVxytl2bs6AwrLbo31zAKfjR44JQ/i3KaDv:pahKxOng0tl2bs/wrIFEqJiE","ssdeep_chunks":["12288:1O/WtWz","12288:O/WtWzh","12288:/WtWzhK","12288:WtWzhKL","12288:tWzhKLw","12288:WzhKLwO","12288:zhKLwOD","12288:hKLwODO","12288:KLwODOn","12288:LwODOng","12288:wODOngk","12288:ODOngkI","12288:DOngkIc","12288:OngkIcY","12288:ngkIcYV","12288:gkIcYVx","12288:kIcYVxy","12288:IcYVxyt","12288:cYVxytl","12288:YVxytl2","12288:Vxytl2b","12288:xytl2bs","12288:ytl2bs6","12288:tl2bs6A","12288:l2bs6Aw","12288:2bs6Awr","12288:bs6AwrL","12288:s6AwrLb","12288:6AwrLbo","12288:AwrLbo3","12288:wrLbo31","12288:rLbo31z","12288:Lbo31zA","12288:bo31zAK","12288:o31zAKf","12288:31zAKfj","12288:1zAKfjR","12288:zAKfjR4","12288:AKfjR44","12288:KfjR44J","12288:fjR44JQ","12288:jR44JQ/","12288:R44JQ/i","12288:44JQ/i3","12288:4JQ/i3K","12288:JQ/i3Ka","12288:Q/i3KaD","12288:/i3KaDv","24576:1O/WtWz","24576:O/WtWzh","24576:/WtWzhK","24576:WtWzhKL","24576:tWzhKLw","24576:WzhKLwO","24576:zhKLwOD","24576:hKLwODO","24576:KLwODOn","24576:LwODOng","24576:wODOngk","24576:ODOngkI","24576:DOngkIc","24576:OngkIcY","24576:ngkIcYV","24576:gkIcYVx","24576:kIcYVxy","24576:IcYVxyt","24576:cYVxytl","24576:YVxytl2","24576:Vxytl2b","24576:xytl2bs","24576:ytl2bs6","24576:tl2bs6A","24576:l2bs6Aw","24576:2bs6Awr","24576:bs6AwrL","24576:s6AwrLb","24576:6AwrLbo","24576:AwrLbo3","24576:wrLbo31","24576:rLbo31z","24576:Lbo31zA","24576:bo31zAK","24576:o31zAKf","24576:31zAKfj","24576:1zAKfjR","24576:zAKfjR4","24576:AKfjR44","24576:KfjR44J","24576:fjR44JQ","24576:jR44JQ/","24576:R44JQ/i","24576:44JQ/i3","24576:4JQ/i3K","24576:JQ/i3Ka","24576:Q/i3KaD","24576:/i3KaDv","12288:pahKxOn","12288:ahKxOng","12288:hKxOng0","12288:KxOng0t","12288:xOng0tl","12288:Ong0tl2","12288:ng0tl2b","12288:g0tl2bs","12288:0tl2bs/","12288:tl2bs/w","12288:l2bs/wr","12288:2bs/wrI","12288:bs/wrIF","12288:s/wrIFE","12288:/wrIFEq","12288:wrIFEqJ","12288:rIFEqJi","12288:IFEqJiE"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":665600,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1723098203000,"last_seen":1788618407000,"last_multi_scan":1788618407000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","rat","remcos","credentialharvesting","xworm","criminal","evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":202,"suspicious_count":24,"malicious_count":19,"total":245},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Taskun","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILHeracles.175385","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Lazy-10034508-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILHeracles.175385 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AMCG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.azr!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b90221 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.LJB.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Taskun.Win32.11553","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILHeracles.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"YARA signature match - Customized RC4 encryption for MSIL"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"YARA signature match - Malware.XWorm"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"suspicious","value":"Drops a file that contains keystrokes (possible keylogger)"},{"type":"suspicious","value":"YARA signature match – Special key logging"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"malicious","value":"Known malware detected"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Sets a windows hook"},{"type":"malicious","value":"Sets a global windows hook to intercept keystrokes"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"brk[~0\" (Indicator: \"brk\"; Source: \"sample.bin\"), Found reference to API \"yBrks\" (Indicator: \"brk\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"zy.ba\", Heuristic match: \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002720.00000000.83179.00260000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002720.00000000.83179.01292000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")\n Found string \"GetProcessById\" (Source: \"00000000-00002720.00000000.83179.01292000.00000020.mdmp, 00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00002720.00000000.83179.01292000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" tries to directly access volume data \"C:\"\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002720.00000001.83674.00A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002720.00000000.83179.01292000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00002720.00000001.83674.00A10000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00002720.00000001.83674.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[ESC]\" (Indicator: \"[esc]\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found string \"[Shift]\" (Indicator: \"[shift]\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found string \"[Back]\" (Indicator: \"[Back]\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found string \"[Tab]\" (Indicator: \"[tab]\"; File: \"00003112.00000C28.12372556.00402000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"ECT * FROM Win32_VideoController\" (Indicator: \" Win32_VideoController\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found string \"elect * from AntivirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")\n Found string \"ELECT * FROM Win32_VideoController\" (Indicator: \" Win32_VideoController\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002720)\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003112)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002288)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002116)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003176)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002936)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\drivers\\etc\\hosts\" (Indicator: \"\\drivers\\\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002720.00000000.83179.00260000.00000004.mdmp, 00000000-00002720.00000001.83674.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002720.00000000.83179.00260000.00000004.mdmp, 00000000-00002720.00000000.83179.01F40000.00000004.mdmp, 00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\\\\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe'\" (UID: 00000000-00002288)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe'\" (UID: 00000000-00002116)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\\\XClient.exe'\" (UID: 00000000-00003176)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'\" (UID: 00000000-00002936)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"XClient.exe\" - Location: [%APPDATA%\\XClient.exe]- [targetUID: 00000000-00003112]\n Dropped file: \"XClient.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\XClient.lnk]- [targetUID: 00000000-00003112]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002116]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"XClient.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" at 00000000-00002720-00000105-6635501\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" at 00000000-00003112-00000105-4239999\n \"powershell.exe\" at 00000000-00002288-00000105-987504\n \"powershell.exe\" at 00000000-00002116-00000105-1039361\n \"powershell.exe\" at 00000000-00003176-00000105-1216489\n \"powershell.exe\" at 00000000-00002936-00000105-943866","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6\" has section name .text with entropy \"7.820834374602701\"\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6\" has section name .rsrc with entropy \"7.408697592917767\"\n \"XClient.exe\" has section name .text with entropy \"7.820834374602701\"\n \"XClient.exe\" has section name .rsrc with entropy \"7.408697592917767\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"ECT * FROM Win32_VideoController\" (Indicator: \" win32_videocontroller\"; File: \"00003112.00000C28.12372556.00402000.wprm\")\n \"ELECT * FROM Win32_VideoController\" (Indicator: \" win32_videocontroller\"; Source: \"00000000-00002720.00000001.83674.01F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/23 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6\" has resource with unusual entropy \"RT_ICON:7.827550936097314\"\n \"XClient.exe\" has resource with unusual entropy \"RT_ICON:7.827550936097314\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"XClient.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\XClient.exe]- [targetUID: 00000000-00003112]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" wrote 10240 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\XClient.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Type::GetField(System.String,System.Reflection.BindingFlags) at c779cc1fe825364c13ae5f33117eb5cd-6000130-PersianDateTimeFormat~SetDateTimeFormatCalendar\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at c779cc1fe825364c13ae5f33117eb5cd-6000203-AboutBox1~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at c779cc1fe825364c13ae5f33117eb5cd-600021f-Form1~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" connects to 104.250.180.178 on port 7061 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Customized RC4 encryption for MSIL","description":"YARA signature for Custom RC4 technique process \"00000000-00002720\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-168","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Special key logging","description":"YARA signature for Special key logging process \"00000000-00003112\"\n YARA signature for Special key logging process \"00000000-00002720\"","origin":"YARA Signature","mitre_attack_id":"T1056.001","relevance":1,"id":"yara-171","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA\" matched process \"00000000-00003112\" as \"Detects Windows executables referencing non-Windows User-Agents\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"4010851\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3501084d\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"20\"}\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"160\"}\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"161\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessById(System.Int32) at c779cc1fe825364c13ae5f33117eb5cd-6000013-Module_~_\n System.Diagnostics.Process::GetProcessById(System.Int32) at c779cc1fe825364c13ae5f33117eb5cd-6000014-Module_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ez4fblwf.2bs.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\pgwfrw2s.pwx.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jddafht4.my3.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\dlwc3mcr.3w0.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\r50qvshv.mfk.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\5qsssf50.ky2.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\s4qwzyqu.rxm.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1gbsjhr2.hem.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\jddafht4.my3.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\dlwc3mcr.3w0.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\r50qvshv.mfk.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\5qsssf50.ky2.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a file that contains keystrokes (possible keylogger)","description":"\"Log.tmp\" contains indicator \"[ENTER]\" (Line: 4; Offset: 0)","origin":"Binary File","mitre_attack_id":"T1056.001","relevance":5,"id":"binary-63","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"C:\\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" called \"CreateProcessA\" with parameter \"C:\\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" - (UID: 00000000-00002720)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 941 instructions to a remote process\n Wrote 379 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/23 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"15/23 Antivirus vendors marked dropped file \"XClient.exe\" as malicious (classified as \"MSIL.Taskun\" with 65% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"15/23 Antivirus vendors marked spawned process \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (PID: 3112) as malicious (classified as \"MSIL.Taskun\" with 65% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 104.250.180.178 on port 7061","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_AsyncRAT\" matched process \"00000000-00003112\" as \"Detects AsyncRAT\"\n YARA signature \"MALWARE_Win_XWorm\" matched process \"00000000-00003112\" as \"Detects XWorm\"\n YARA signature \"MALWARE_Win_AsyncRAT\" matched process \"00000000-00002720\" as \"Detects AsyncRAT\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Malware.XWorm","description":"YARA signature Malware.XWorm matched on process \"00000000-00003112\"","origin":"YARA Signature","mitre_attack_id":"T1204.002","relevance":10,"id":"yara-24","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Known malware detected","description":"The sample is known malware – XWorm RAT","origin":"Indicator Combinations","mitre_attack_id":"T1219","relevance":10,"id":"summary-5035","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\\\\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe'\" (UID: 00000000-00002288)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe'\" (UID: 00000000-00002116)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\\\XClient.exe'\" (UID: 00000000-00003176)\n Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'\" (UID: 00000000-00002936)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (UID: 00000000-00002720)\n Spawned process \"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe\" (UID: 00000000-00003112)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\\\\913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe'\" (UID: 00000000-00002288)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6.exe'\" (UID: 00000000-00002116)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\\\XClient.exe'\" (UID: 00000000-00003176)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'\" (UID: 00000000-00002936)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00003580)\n \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00003580)\n \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00003580)\n \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00003580)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"LoadResource with parameter {'hModule': '49414145', 'hResInfo': '49415392'}\" (UID: 00000000-00003580)\n \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"LoadResource with parameter {'hModule': '49414145', 'hResInfo': '49415424'}\" (UID: 00000000-00003580)\n \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"LoadResource with parameter {'hModule': '49414145', 'hResInfo': '49415440'}\" (UID: 00000000-00003580)\n \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"LoadResource with parameter {'hModule': '49414145', 'hResInfo': '49415408'}\" (UID: 00000000-00003580)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00000660.00000000.162981.716E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data.\" (Indicator: \"Format-Hex\"; Source: \"00000000-00002716.00000000.161523.06CF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000660.00000000.162981.03090000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002716.00000000.161523.006D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133675970768446487.2716.DefaultAppDomain.powershell; Source: \"00000000-00002716-00000C52-1527788658\")\n Found string - \\\\.\\pipe\\PSHost.133675972711276794.7312.DefaultAppDomain.powershell; Source: \"00000000-00007312-00000C52-1539726622\")\n Found string - \\\\.\\pipe\\PSHost.133675974255629011.660.DefaultAppDomain.powershell; Source: \"00000000-00000660-00000C52-1550607457\")\n Found string - \\\\.\\pipe\\PSHost.133675975760381209.6324.DefaultAppDomain.powershell; Source: \"00000000-00006324-00000C52-1562625497\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000660.00000000.162981.08CF0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000660.00000000.162981.08D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"D ^ 2\" (Indicator: \" ^ \"; Source: \"00000000-00000660.00000000.162981.09110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000660.00000000.162981.716E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000660.00000000.162981.716E1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" queries volume information of \"C:\\\" at 00000000-00005548-00000C15-1569880140\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002716-00000C15-1528729882\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007312-00000C15-1540659282\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00000660-00000C15-1551503373\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006324-00000C15-1563140576","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003580)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002716)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007312)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000660)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006324)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"HBLTSNCNC17066 +Arrival Notice - WAN HAI 271S216.scr\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72100000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72100000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"WScript.Shell.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath\" (Indicator: \"Resolve-Path\"; Source: \"00000000-00000660.00000000.162981.078F0000.00000004.mdmp\")\n Found string \"if(Test-Path -LiteralPath $filePath -PathType Container)\" (Indicator: \"Test-Path\"; Source: \"00000000-00000660.00000000.162981.078F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" sets a global windows hook with filter \"WH_KEYBOARD_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005548)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe.log\"\n \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00005548\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00006324\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"GetComputerNameW\" (UID: 00000000-00005548)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002716)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" called \"GetUserNameW\" (UID: 00000000-00005548)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002716)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007312)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00000660)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006324)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00000660.00000000.162981.078F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"11237750114,5888,3141,,GetComputerNameW,kernel32.dll,\"00:42:26.312\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000660.00000000.162981.078F0000.00000004.mdmp\")\n Found reference to API \"11485180862,5888,3141,,GetComputerNameW,kernel32.dll,\"00:42:26.421\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000660.00000000.162981.078F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"HBLTSNCNC17066 +Arrival Notice - WAN HAI 271S216.scr\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000660.00000000.162981.716E1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3580)\n \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5548)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 2716)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 7312)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 660)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6324)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002716)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00002716)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007312)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000660.00000000.162981.08D60000.00000004.mdmp\")\n Found string \"ping 0~\" (Indicator: \"ping\"; Source: \"00000000-00002716.00000000.161523.02AB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" set thread context in remote process \"C:\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" (PID: 15ac)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$52","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Sets a global windows hook to intercept keystrokes","description":"\"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" set a windows hook with filter \"WH_KEYBOARD_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-72","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" (UID: 00000000-00003580)\n Spawned process \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" (UID: 00000000-00002204)\n Spawned process \"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe\" (UID: 00000000-00005548)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\\\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe'\" (UID: 00000000-00002716)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe'\" (UID: 00000000-00007312)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\\\XClient.exe'\" (UID: 00000000-00000660)\n Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'\" (UID: 00000000-00006324)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]}],"intel_graph":{"map":{"File:23c04fddaa10101474eb4a64b80acd181e8971dad5dae85e209af2467c1b8651":{"type":"File","value":"23c04fddaa10101474eb4a64b80acd181e8971dad5dae85e209af2467c1b8651"},"File:28451a5f11aa8ff490df32b5a6c845e053c7865e39f660477fee4e4e1dffef32":{"type":"File","value":"28451a5f11aa8ff490df32b5a6c845e053c7865e39f660477fee4e4e1dffef32"},"File:317c558bdd005439887cd6753c51f989e9b13134771b55eadd5758a76c4b0a79":{"type":"File","value":"317c558bdd005439887cd6753c51f989e9b13134771b55eadd5758a76c4b0a79"},"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6":{"type":"File","value":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","verdict":{"verdict":"suspicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as packed by ClamAV antivirus"]}},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd":{"type":"File","value":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},"Ip:104.250.180.178":{"type":"Ip","value":"104.250.180.178"}},"chains":[{"id":"1545802388327135931","root":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as packed by ClamAV antivirus"]}},{"id":"sandbox_network","root":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","edges":[{"edge_kind":"contacted_ip","from_key":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","to_key":"Ip:104.250.180.178"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","edges":[{"edge_kind":"extracted","from_key":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","to_key":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6"},{"edge_kind":"extracted","from_key":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","to_key":"File:317c558bdd005439887cd6753c51f989e9b13134771b55eadd5758a76c4b0a79"},{"edge_kind":"extracted","from_key":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","to_key":"File:28451a5f11aa8ff490df32b5a6c845e053c7865e39f660477fee4e4e1dffef32"},{"edge_kind":"extracted","from_key":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","to_key":"File:23c04fddaa10101474eb4a64b80acd181e8971dad5dae85e209af2467c1b8651"},{"edge_kind":"extracted","from_key":"File:913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","to_key":"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":33,"imported_dlls_count":208,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":25,"files_deleted_count":0,"registry_keys_created_count":35,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":35,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","rat","remcos","credentialharvesting","xworm","criminal","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a9c26a6924edac26d0e6fba","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL.Taskun","contacted_countries":["DEU"],"submit_name":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","analysis_start_time":"2026-09-05T14:26:47+00:00","indicators_count":{"informative":163,"suspicious":39,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"66b4645b0ce185cb77031b17","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr","analysis_start_time":"2024-08-08T06:23:23+00:00","indicators_count":{"informative":120,"suspicious":40,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.250.180.178","port":7061,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}],"processes":[{"pid":3580,"ppid":0,"name":"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe","command_line":"","sha256":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","normalized_path":"C:\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe","uid":"00000000-00003580","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABQ0lEQVR4Xu2PzUoCURTHB6mmUEgJjGzfynfoHXwDX6A3CGzVE/QorQuiRQsJazMZuhCRaiEhEn0sbpzRM9w5H3OvQeDi/uAww5z/x5koCgQCgQLiODbwHE1nhs5B4zDdAf3JK9vDwO765jbTrcT7/MPAwDsNxvAizfBtyjQrgUapgO6T54FTc9o58z/CNsKUy5WsYLdaZeF45ONwlJV3ew+5PWqcUJNtlv6MapLxi1OzvrSfvo098G3n/sdoo/lcGehj+JhpCL5Tb1EGehk+ZrsQ9xsn5+oRUgb2MVzmzbvFt+29OtunAaXS/x0QXX2a6LiV+1N7j8Ht5EvN+PMBaTkM0eCehvtoRKQDtHItnB4haZZ1HKlAK9fCYbYuLjOPpFnWcexwW1g7arJyLVwqKdrlgND9HhfSYp8DbL/2PRAIBIBf3MiikaEpqU0AAAAASUVORK5CYII="},{"pid":2204,"ppid":3580,"name":"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe","command_line":"","sha256":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","normalized_path":"C:\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe","parent_uid":"00000000-00003580","uid":"00000000-00002204"},{"pid":5548,"ppid":3580,"name":"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe","command_line":"","sha256":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","normalized_path":"C:\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe","parent_uid":"00000000-00003580","uid":"00000000-00005548"},{"pid":2716,"ppid":5548,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe'","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005548","uid":"00000000-00002716"},{"pid":7312,"ppid":5548,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe'","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005548","uid":"00000000-00007312"},{"pid":660,"ppid":5548,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '%APPDATA%\\XClient.exe'","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005548","uid":"00000000-00000660"},{"pid":6324,"ppid":5548,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005548","uid":"00000000-00006324"}],"all_imported_dlls":["nsi.dll","api-ms-win-crt-string-l1-1-0.dll","mscorlib.ni.dll","System.Windows.Forms.ni.dll","WSHTCPIP.DLL","ws2_32.dll","fltLib.dll","shlwapi.dll","Microsoft.VisualBasic.ni.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","atl.dll","GdiPlus.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","KernelBase.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","System.Drawing.ni.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","Microsoft.BackgroundIntelligentTransfer.Management.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","bcryptprimitives.dll","mscoree.dll","sspicli.dll","Microsoft.Windows.Diagnosis.SDEngine.dll","System.Core.ni.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","setupapi.dll","Microsoft.PowerShell.Commands.Management.ni.dll","nlssorting.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","WindowsCodecs.dll","ieframe.dll","ncrypt.dll","Microsoft.CSharp.ni.dll","Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","VxSSL32.dll","vcruntime140.dll","linkinfo.dll","mswsock.dll","ucrtbase.dll","normaliz.dll","propsys.dll","devobj.dll","scrrun.dll","shdocvw.dll","api-ms-win-core-localization-l1-2-0.dll","cryptsp.dll","api-ms-win-downlevel-version-l1-1-0.dll","Wldap32.dll","wintrust.dll","pwrshsip.dll","System.Data.ni.dll","System.Transactions.ni.dll","sechost.dll","mscoreei.dll","System.Data.dll","Microsoft.Management.Infrastructure.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","msvcrt.dll","api-ms-win-core-processthreads-l1-1-1.dll","userenv.dll","System.Management.Automation.ni.dll","diasymreader.dll","usp10.dll","imm32.dll","api-ms-win-core-xstate-l2-1-0.dll","ntmarta.dll","msisip.dll","clr.dll","System.ni.dll","comctl32.dll","wininet.dll","mpr.dll","slc.dll","System.Numerics.ni.dll","Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll","oleaut32.dll","System.Configuration.ni.dll","iertutil.dll","rpcrt4.dll","lpk.dll","api-ms-win-crt-heap-l1-1-0.dll","cryptbase.dll","msasn1.dll","Microsoft.PowerShell.Security.ni.dll","apphelp.dll","gdi32.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","RpcRtRemote.dll","sxs.dll","clrjit.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","Microsoft.PowerShell.LocalAccounts.dll","cryptnet.dll","SensApi.dll","rpcss.dll","uxtheme.dll","bcrypt.dll","srvcli.dll","System.DirectoryServices.ni.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll","api-ms-win-crt-locale-l1-1-0.dll","mscorrc.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","user32.dll","version.dll","clbcatq.dll","System.Management.Automation.dll","wshext.dll","api-ms-win-core-timezone-l1-1-0.dll","System.Windows.Forms.dll","urlmon.dll","Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll","gpapi.dll","cfgmgr32.dll","cscapi.dll","System.Management.ni.dll","System.Transactions.dll","AutoItX3.PowerShell.dll","ntdll.dll","msvcp140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","msctf.dll","profapi.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wship6.dll","crypt32.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll","ole32.dll","psapi.dll","rsaenh.dll","ntshrui.dll","System.Configuration.Install.ni.dll","kernel32.dll","advapi32.dll","System.Xml.ni.dll","shell32.dll","secur32.dll","MpOAV.dll","imagehlp.dll","cldapi.dll","amsi.dll","kernel.appcore.dll","xmllite.dll","msIso.dll","wbemcomn.dll","Microsoft.PowerShell.ConsoleHost.dll","wmidcom.dll","OneCoreUAPCommonProxyStub.dll","combase.dll","Microsoft.VisualBasic.dll","wow64cpu.dll","Microsoft.PowerShell.Security.dll","wbemsvc.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","dpapi.dll","Windows.StateRepositoryPS.dll","winmm.dll","msvcp_win.dll","fastprox.dll","Microsoft.AppV.AppVClientPowerShell.dll","mi.dll","OpcServices.dll","Microsoft.PowerShell.Commands.Utility.dll","msvfw32.dll","sppc.dll","SHCore.dll","dwmapi.dll","gdi32full.dll","powrprof.dll","Accessibility.dll","MpClient.dll","aepic.dll","wbemprox.dll","System.DirectoryServices.dll","windows.storage.dll","Microsoft.BitLocker.Structures.dll","System.Numerics.dll","System.Configuration.Install.dll","DWrite.dll","edputil.dll","wmiutils.dll","Microsoft.AppV.AppvClientComConsumer.dll","avicap32.dll","Microsoft.PowerShell.Commands.Management.dll","miutils.dll","winmmbase.dll","coml2.dll","winnsi.dll","wldp.dll","Microsoft.Management.Infrastructure.Native.dll","wow64win.dll","System.Management.dll","IPHLPAPI.DLL","AppxSip.dll","wow64.dll","win32u.dll","WMINet_Utils.dll","System.Drawing.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"XClient.exe","sha256":"913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"XClient.lnk","sha256":"317c558bdd005439887cd6753c51f989e9b13134771b55eadd5758a76c4b0a79","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Log.tmp","sha256":"28451a5f11aa8ff490df32b5a6c845e053c7865e39f660477fee4e4e1dffef32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe.log","sha256":"23c04fddaa10101474eb4a64b80acd181e8971dad5dae85e209af2467c1b8651","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%APPDATA%\\XClient.exe","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\XClient.lnk","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\Log.tmp","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\ez4fblwf.2bs.ps1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"path":"%TEMP%\\pgwfrw2s.pwx.psm1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"path":"%TEMP%\\jddafht4.my3.ps1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"path":"%TEMP%\\dlwc3mcr.3w0.psm1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"path":"%TEMP%\\r50qvshv.mfk.ps1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"path":"%TEMP%\\5qsssf50.ky2.psm1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"path":"%TEMP%\\s4qwzyqu.rxm.ps1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"path":"%TEMP%\\1gbsjhr2.hem.psm1","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\HBLTSNCNC17066_ArrivalNotice_-WANHAI271S216.scr.exe.log","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_kray4xf2.kax.ps1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zquqvhcv.eod.psm1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2w3lh0jm.lhf.ps1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_sczqxiys.bxe.psm1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_g32c0iah.1ny.ps1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_cwip0o5c.cpb.psm1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_kgx32uqn.44n.ps1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zumrj5as.pep.psm1","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"},{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\f8RKHn3SOlVxjC9t","sources":[{"report_type":"sandbox","report_id":"6a9c26a6924edac26d0e6fba"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:3580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:3580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:3580:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:3580:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:5548:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:5548:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"f8RKHn3SOlVxjC9t","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:5548:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:5548:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:2716:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:2716:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:2716:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:2716:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:7312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:7312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:7312:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:7312:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:660:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:660:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:660:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:660:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:6324:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"Local\\SM0:6324:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:6324:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]},{"name":"SM0:6324:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b4645b0ce185cb77031b17"}]}]}},"report_ids":{"sandbox_job_ids":["6a9c26a6924edac26d0e6fba","66b4645b0ce185cb77031b17"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSILHeracles.Generic Sample 913088dfb9d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 913088dfb9d0…. Malware family: MSILHeracles.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 19 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILHeracles.Generic Sample 913088dfb9d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 913088dfb9d0…. Malware family: MSILHeracles.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 19 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/913088dfb9d020b0d590b474cb80dcec701eedc7494a0a4c4854853bb21fd2c6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILHeracles.Generic Sample 913088dfb9d0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 913088dfb9d0…. Malware family: MSILHeracles.Generic. Threat score 100/100. 16/24 AV engines flagged this file. 19 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L53","11",{}]]