21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 930df163cb5e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 930df163cb5e…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 4/25 AV engines flagged this file. 7 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/930df163cb5ea7e0b9a2ec3bdffd460a598cda23fe4bb8df5faf9bbeaad589f7","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","930df163cb5ea7e0b9a2ec3bdffd460a598cda23fe4bb8df5faf9bbeaad589f7"],"about":{"@type":"SoftwareApplication","name":"Installer_v1836_x64.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"930df163cb5ea7e0b9a2ec3bdffd460a598cda23fe4bb8df5faf9bbeaad589f7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":4,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAGZmZmZmYAAABmZmZmZmAAZmZmZmZmYAAGZmZmZmZmBmZmZmZmZmAABmZmZmZmZmZmVVVVVVZmAGZKqqqqqmZmZlVVVVVWZgBmaqqqqqpmZmZVVVVVVmYAZmqqqqqqZmZmVVVVVVZmAGZqqqqqqmZmZlVVVVVWZgBmaqqqqqpmZmaIiIiIhmYAZkd3d3d3ZmZmiIiIiIZmAGZHd3d3d2ZmZoiIiIiGZgBmR3d3d3dmZmaIiIiIdmYABmd3d3d6ZmZmZmZmZmZgAAZmRERERGZgRmZmZmZmAAAAZmZmZmZmAABmZmZmYAAAAABmZmZmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmZmZmYAAAAAZmZmZmAABmZmZmZmYAAABmZmZmZmYGZkRERERmYAAGZmZmZmZmZmand3d3dmYAZmeIiIiIZmZmd3d3d3RmAGZoiIiIiGZmZnd3d3d0ZgBmaIiIiIhmZmZ3d3d3dGYAZmiIiIiIZmZmd3d3d3RmAGZoiIiIiGZmZnd3d3d0ZgBmaIiIiIhmZmZ3d3d3dGYAZmiIiIiIZmZmd3d3d3RmAGZoiIiIiGZmZnd3d3ekZgBmaIiIiIdmZmZGZmZmZmAABmZmZmZmZmBmZmZmZmZgAARmZmZmZmYABmZmZmZmAAAAZmZmZmZgCAA+AAAAHAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwAAAAcAAgAPgAeAP+AP//////////8AD4AGAAcAAAAHAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwACAA8AAwAfgAQ==23:T525,Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp, 00000000-00002148.00000002.169455.59EE2000.00000002.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp, 00000000-00002148.00000002.169455.59EE2000.00000002.mdmp") Found string "DisableScriptScanning" (Indicator: "disablescriptscanning"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp") Found string "DisableBlockAtFirstSeen" (Indicator: "disableblockatfirstseen"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00002696.00000000.167334.65A32000.00000002.mdmp, 00000000-00002696.00000001.167572.D2C5D000.00000004.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00002696.00000000.167334.65A32000.00000002.mdmp, 00000000-00002696.00000001.167572.D2C14000.00000004.mdmp, 00000000-00002696.00000001.167572.D2C5D000.00000004.mdmp")24:T41b,Found string "+ncalrpc:[OLE5C60CFB47D8923A409BC1BB86E2F]" (Indicator: "ncalrpc"; Source: "00000000-00001508.00000000.169254.3E7F0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001508.00000000.169254.3E7F0000.00000004.mdmp") Found string "+ncalrpc:[OLE9AF6C4FDE91FECF3B39AE5BAA3B9]" (Indicator: "ncalrpc"; Source: "00000000-00001508.00000000.169254.3E7F0000.00000004.mdmp") Found string "+ncalrpc:[OLE7803F73ABBCAE9123B71694563E0]" (Indicator: "ncalrpc"; Source: "00000000-00002148.00000000.167141.9BE50000.00000004.mdmp, 00000000-00002148.00000001.169063.9BE50000.00000004.mdmp, 00000000-00002148.00000002.169455.9BE8A000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp") Found string "+ncalrpc:[OLE578876E81BA93E06654D754C9B5A]" (Indicator: "ncalrpc"; Source: "00000000-00002696.00000000.167334.B8160000.00000004.mdmp, 00000000-00002696.00000001.167572.B818E000.00000004.mdmp")25:T5ec,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp, 00000000-00002148.00000002.169455.59EE2000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp, 00000000-00002148.00000002.169455.59EE2000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp, 00000000-00002148.00000002.169455.59EE2000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002148.00000002.169455.59E28000.00000002.mdmp, 00000000-00002148.00000002.169455.59EE2000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002696.00000000.167334.65A32000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002696.00000000.167334.65A32000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002696.00000000.167334.65A32000.00000002.mdmp, 00000000-00002696.00000000.167334.E6EBA000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002696.00000000.167334.65A32000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002696.00000000.167334.E6EBA000.00000002.mdmp")26:T482,"" - Source: "00000000-00002148.00000002.169455.59EE2000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002148.00000002.169455.9BE50000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002696.00000000.167334.65A32000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcredmncipappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46@'zglobalsign" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;0q" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erismywmmew8-lqw$!+ef" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.8ecdp1.2.840.10045.3.1.1@eckp1.3.132.0.31@eckp1.3.132.0.33@eckp1.3.132.0.33ecdp1.3.132.0.34ecdp1.3.132.0.30@eckp1.3.132.0.34@eckp1.3.132.0.10@eckp1.2.840.10045.3.1.7@eckp1.3.6.1.4.1.311.60.3.11.3.132.0.9@eckp1.3.132.0.8@eckp1.3.132.0.33ecdp1.3.132.0.35@eckp" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002696.00000000.167334.D25A0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002696.00000000.167334.D2A80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002696.00000000.167334.D2A80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002696.00000000.167334.D2A80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4@]w" - Source: "00000000-00002696.00000001.167572.B818E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcredmncipappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e46@'zglobalsign" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;0q" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erismywmmew8-lqw4eru" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002696.00000001.167572.D25A0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002696.00000001.167572.D25F3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.8ecdp1.2.840.10045.3.1.1@eckp1.3.132.0.31@eckp1.3.132.0.33@eckp1.3.132.0.33ecdp1.3.132.0.34ecdp1.3.132.0.30@eckp1.3.132.0.34@eckp1.3.132.0.10@eckp1.2.840.10045.3.1.7@eckp1.3.6.1.4.1.311.60.3.11.3.132.0.9@eckp1.3.132.0.8@eckp1.3.132.0.33ecdp1.3.132.0.35@eckp" - Source: "00000000-00002696.00000001.167572.D25F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00002696.00000001.167572.D25F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002696.00000001.167572.D25F3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00002696.00000001.167572.D25F3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002696.00000001.167572.D25F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrmn9iqmgvw,czcdigicert" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%y2.5.29.11l1" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.mi-iprod*/mic:it2011_20" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsa+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com/windows)a]n9_]n1" - Source: "00000000-00007196.00000000.168820.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007196.00000000.168820.F8620000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mic" - Source: "00000000-00007196.00000000.168820.F8620000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007196.00000000.168820.F8620000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007196.00000001.168993.DDC00000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007196.00000001.168993.DDC00000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007196.00000001.168993.DDC00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcdigicert" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%y2.5.29.11l1" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.mi-iprod*/mic:it2011_20" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007196.00000001.168993.F8100000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007196.00000001.168993.F81E5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00007196.00000001.168993.F81E5000.00000004.mdmp") Found URL "http://www.microsoft.com/windowss'>o" - Source: "00000000-00007196.00000001.168993.F81E5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0[u" - Source: "00000000-00007196.00000001.168993.F81E5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mic" - Source: "00000000-00007196.00000001.168993.F8620000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007196.00000001.168993.F8620000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007196.00000001.168993.F8720000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007196.00000001.168993.F8720000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007196.00000001.168993.F8720000.00000004.mdmp")55:T3353,"REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001508.00000000.169254.3E7F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0&" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "SOFTWARE\VMware, Inc.\VMware Tools" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "SOFTWARE\Oracle\VirtualBox Guest Additions" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\VBoxGuest" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\VBoxSF" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001508.00000000.169254.409E0000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00001508.00000000.169254.59480000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8" in Source: 00000000-00001508.00000000.169254.59480000.00000004.mdmp "Win32Registry|HARDWARE\Description\System|SystemBiosVersion" in Source: 00000000-00001508.00000000.169254.59495000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002148.00000000.167141.9BE50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002148.00000000.167141.9BE50000.00000004.mdmp "Software\Classes\PackagedCom" in Source: 00000000-00002148.00000000.167141.9BE50000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002148.00000000.167141.9BE50000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002148.00000000.167141.9BE50000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002148.00000000.167141.9BE50000.00000004.mdmp "y\Machine\Software\Classes\A" in Source: 00000000-00002148.00000000.167141.9BE50000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002148.00000000.167141.9BE50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002148.00000001.169063.9BE50000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002148.00000001.169063.9BE50000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002148.00000001.169063.9BE50000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002148.00000001.169063.9BE50000.00000004.mdmp "y\Machine\Software\Classes\A" in Source: 00000000-00002148.00000001.169063.9BE50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002148.00000001.169063.9BE50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002148.00000001.169063.9E1E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002148.00000001.169063.9E1E0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00002148.00000002.169455.59E28000.00000002.mdmp "HKLM\" in Source: 00000000-00002148.00000002.169455.59E28000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00002148.00000002.169455.59E28000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002148.00000002.169455.59E28000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00002148.00000002.169455.59E28000.00000002.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00002148.00000002.169455.9BEFE000.00000004.mdmp "y\Machine\Software\Classes\A" in Source: 00000000-00002148.00000002.169455.9BEFE000.00000004.mdmp "21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002148.00000002.169455.9BEFE000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002148.00000002.169455.9E1E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002148.00000002.169455.9E1E0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002696.00000000.167334.B8160000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002696.00000000.167334.B8160000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002696.00000000.167334.B8160000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002696.00000000.167334.B8160000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002696.00000000.167334.D25A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002696.00000000.167334.D25A0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002696.00000000.167334.E6EBA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002696.00000000.167334.E6EBA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002696.00000000.167334.E6EBA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002696.00000000.167334.E6EBA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002696.00000000.167334.E6EBA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002696.00000000.167334.E6EBA000.00000002.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002696.00000001.167572.B818E000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002696.00000001.167572.B818E000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002696.00000001.167572.B818E000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002696.00000001.167572.B818E000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002696.00000001.167572.D25A0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6@" in Source: 00000000-00002696.00000001.167572.D2C14000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00002696.00000001.167572.D2C5D000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\G" in Source: 00000000-00002696.00000001.167572.D2C5D000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007196.00000000.168820.DDC00000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007196.00000000.168820.DDC00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000000.168820.DDC00000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000000.168820.DDC00000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007196.00000000.168820.DDC00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007196.00000000.168820.F8100000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007196.00000001.168993.DDC00000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007196.00000001.168993.DDC00000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000001.168993.DDC00000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000001.168993.DDC00000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007196.00000001.168993.DDC00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007196.00000001.168993.F8100000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00007196.00000001.168993.F81E5000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00007196.00000001.168993.F81E5000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Registry\Machine\Software\Classes\DelegateFolders" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "001\Software\MicrosP" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "les\Registry\Machine\Software\Classes\WOW64r" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}=DESKTOP-FVV"" in Source: 00000000-00007196.00000001.168993.F8720000.00000004.mdmp56:T9a9,Found reference string ""powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('%TEMP%\','C:\930df1" (Indicator: "add-mppreference"; Source: "00000000-00002148-00000C47-6951196074") file/memory contains long string with (Indicator: "add-mppreference"; File: "AMSI") file/memory contains long string with (Indicator: "add-mppreference"; File: "powershell.exe") file/memory contains long string with (Indicator: "add-mppreference"; Source: "00000000-00002148.00000000.167141.9BE50000.00000004.mdmp") Found reference string "-WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('" (Indicator: "add-mppreference"; Source: "00000000-00002148.00000001.169063.9E1E0000.00000004.mdmp, 00000000-00002148.00000002.169455.9E1E0000.00000004.mdmp") Found reference string "','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('" (Indicator: "add-mppreference"; Source: "00000000-00002148.00000001.169063.9E1E0000.00000004.mdmp, 00000000-00002148.00000002.169455.9E1E0000.00000004.mdmp") file/memory contains long string with (Indicator: "add-mppreference"; Source: "00000000-00002148.00000001.169063.9E1E0000.00000004.mdmp, 00000000-00002148.00000002.169455.9E1E0000.00000004.mdmp") file/memory contains long string with (Indicator: "add-mppreference"; Source: "00000000-00002696.00000000.167334.B8160000.00000004.mdmp, 00000000-00002696.00000001.167572.B8160000.00000004.mdmp") file/memory contains long string with (Indicator: "add-mppreference"; Source: "00000000-00002696.00000000.167334.B8160000.00000004.mdmp, 00000000-00002696.00000001.167572.D2C37000.00000004.mdmp") file/memory contains long string with (Indicator: "add-mppreference"; Source: "00000000-00002696.00000000.167334.B8160000.00000004.mdmp, 00000000-00002696.00000001.167572.B818E000.00000004.mdmp") file/memory contains long string with (Indicator: "add-mppreference"; Source: "00000000-00002696.00000000.167334.B8160000.00000004.mdmp, 00000000-00002696.00000000.167334.B8320000.00000004.mdmp, 00000000-00002696.00000000.167334.D25A0000.00000004.mdmp, 00000000-00002696.00000001.167572.B8160000.00000004.mdmp, 00000000-00002696.00000001.167572.B818E000.00000004.mdmp, 00000000-00002696.00000001.167572.B82D0000.00000004.mdmp, 00000000-00002696.00000001.167572.B8320000.00000004.mdmp, 00000000-00002696.00000001.167572.D25F3000.00000004.mdmp")57:T8a8,"