26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample e108137aa046… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e108137aa046…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 19 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e108137aa0469b5a1affc9d86a92e9e844a9540d9082ca5511b67de114310f88","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","e108137aa0469b5a1affc9d86a92e9e844a9540d9082ca5511b67de114310f88"],"about":{"@type":"SoftwareApplication","name":"PROFORMA INVOICE.pdf.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"e108137aa0469b5a1affc9d86a92e9e844a9540d9082ca5511b67de114310f88","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":19,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T507,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp")28:T553,Found PE header "MZ" - Source: "00000000-00002024.00000000.68746.00E70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002024.00000000.68746.6EAC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006424.00000000.68368.00B20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006424.00000000.68368.098B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006424.00000000.68368.09A10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006424.00000000.68368.0C200000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006424.00000000.68368.6E530000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006424.00000000.68368.6E5D0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006456.00000000.78359.00E70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006456.00000000.78359.71890000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007832.00000000.68729.00E70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007832.00000000.68729.6EAC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007896.00000000.78365.00E70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00007896.00000000.78365.71890000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00008104.00000000.78149.00C20000.00000002.mdmp")29:T742,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007832-318-6-00E78190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007832-318-6-00E78190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002024-4262-21-00E7C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002024-4262-21-00E7C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002024-4262-6-00E78190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002024-4262-6-00E78190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006456-10435-6-00E78190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006456-10435-6-00E78190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006456-10435-21-00E7C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006456-10435-21-00E7C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007896-14701-6-00E78190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007896-14701-6-00E78190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007896-14701-21-00E7C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007896-14701-21-00E7C4B6 Assembly shows XOR instruction xor cl byte ptr [ecx] in Stream UID: 16009-1-0049EB22 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 16009-1-0049EB22 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 16009-1-0049EB22 Assembly shows XOR instruction xor eax 6F0A0000h in Stream UID: 16009-1-0049EB22 Assembly shows XOR instruction xor byte ptr [000CD700h] al in Stream UID: 16009-1-0049EB22 Assembly shows XOR instruction xor byte ptr [0010B700h] al in Stream UID: 16009-1-0049EB222a:T400,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys2b:T20a5,"PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000a7f55ec3232540736027f500687d677600f6f50030544073bb00e9b0feffffff1cf5f500b2403f73c0f4f50000002274b8f5f500cb403f73e0df497608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000048f5f50000000000080000000000000000000000000000000000000000000000000022748ff55ec30000000088f5f5006992e674ffffffff3400000048f5f500080000000000000000002274b8f5f5002794e67450f5f5000b00000000000000a0f5f500 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a8d7f5004cd7f500226e817600008003000000002d6e8176632524872d000000ecb71575d0d7f500000006039816210320ee1e030d0000008000000010d7f5000000060394d7f50070c88276d78356f1feffffff2d000000d0cc24752700000064d7f500856a83761c238876a4d7f500f85f837608000000bb698276b26982768b2524872d000000ecb7157527000000d0cc247578d7f5002d000000d0cc247527000000a8d7f500856a83761c238876f0d7f5007e8a2375ee8c2375738a237520e4fbaf2d000000ecb7157527000000d0cc2475e42880037828800320e4fbafb8d7f500fc526175a4d8f500e0842375e8c251dafeffffff738a2375 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000c96e187dc96e00000000d0a9df760000d8769011d976a812200338b01a03d0c5200368edf500feffffff10f0f500506a1c77d78985cefeffffff28eef500eaa91877a812200300000000d0c52003a11400000a000b00b297c96e5c76c96e6876c96ed0c52003d0592003140000000000000000000000a812200350eef500cc2d1d77d0c5200300000000dcc5200300000000f800c26e00000000cc0d24385ce81b7768401a770403000019000000110000001000000078bd190388eef5008d9aae73f0bc19034c9a1f0300000000a8eef50054bd19034c9a1f03c0eef5000000c26efeffffff0400000020afae7300000000000000000000c26eb0eef500 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000020035005cb72000000002a009273fc868b732a009273fb8c19770000000000000000fc868b7314f1f5000000000000000000000000002a009273090000008819200309000000fc868b73000000005005cb725ff15e00232540732823f5005054170520f5f50030544073bb00e9b0feffffffd0f0f500ea5e3f7380f0f5000000000000000000035f3f73fcf0f50000000000000000000000000000000000000000000000000001000000000000000100000000000000f8f0f5000000000008f1f50000000000fcf0f50000000000000000000000000020f5f50047f15ec314f1f50084dae47401000000b78c54b918f1f500dab9e4740000c2720cf1f500 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000019770000000011b9e47400000000c4502674000000001c00000000008003e8e4f500000000002d9d5d6ea3011977f79954b9b8714d08d007920728000000d0745d6e73000000000092070000000091a200020000000086030085f02f4d08a08080031d000000000000002000000000009207cc0192070408920700000000000892076ce6f500e0e4f500591619771c0000000000000004075c6e00008003c82120032800000000000000000000000500000002000000000080031c000000000000005c5b800300e5f500ee1319771c000000ee13197700000000000000001c000000ffffffff20e5f5005072817600008003000000001c00000004075c6e (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000001877e0454f08e0454f0800000000a0904f0890e14e08683b4f082f000000a0e14e081100250050f51877e0714e08e0714e08000000002b17248788e04d08e8624e082b00000098e04d080a00290050f51877a8884d08a8884d0800000000e0454f08e0808003c0874d0806000000f08080030b000600700a92076400000063172487e0714e08e0714e0800000000feffffff8470817678e5f5006570817600008003000000008470817657172487a8884d08a8884d0800000000e32e586ee0714e08b5ce546ed35764dd40e5f500176f556ed4e5f50070c882760f8056f1feffffff847081760a8e576ea8884d08f08d576ea0e5f500a7ce546e01000000 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000187708434f0808434f08000000000000000090e14e08683b4f082200000050f51877e0714e08e0714e08000000008470817688e04d08e8624e082b00000098e04d080a002c00480d92076400000050f51877688b4d08688b4d080000000008434f08e0808003c0874d081c000000f08080030b001c00700a920764000000e0714e08e0714e0800000000feffffff8470817674e5f500657081760000800300000000847081765b172487688b4d08688b4d0800000000e32e586ee0714e08b5ce546eef5764dd3ce5f500176f556ed4e5f50070c882760f8056f1feffffff847081760a8e576e688b4d08f08d576e9ce5f500a7ce546e01000000504b556e (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000a0c6f60a38cf19771c3619030cc7f60a01000000d03519031c361903d0351903040000000400000000e0f074001000000cc7f60a01000000d0351903cd9719779c9719777bb557b3b50fe774d03519030000197700000000ec1bfa690000000080eeed740100000000000000f8e2f074000000000400000080a9ae734840ef74f8e2f07410c7f60a80e858749826200380e858740cc7f60a0000000080e8587400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000060125031c012503 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000006b71f031eb71f03 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000169e1f032a9e1f03 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000060125031c012503 (UID: 00000000-00006424)2c:T571,"PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "schtasks.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "RegSvcs.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yhKpVNQhndht.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yhKpVNQhndht.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2d:T9e5,"RegSvcs.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")2e:T4f9,"PROFORMAINVOICE.pdf.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\PROFORMAINVOICE.pdf.exe"" - (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\yhKp" - (UID: 00000000-00006424), "PROFORMAINVOICE.pdf.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\yhKpVNQhndht" /XML "%TEMP%\tmp5054.tmp"" - (UID: 00000000-00006424), "PROFORMAINVOICE.pdf.exe" called "CreateProcessA" with parameter "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" - (UID: 00000000-00006424), "yhKpVNQhndht.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\yhKp" - (UID: 00000000-00008104) "yhKpVNQhndht.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\yhKpVNQhndht" /XML "%TEMP%\tmp9B6D.tmp"" - (UID: 00000000-00008104) "yhKpVNQhndht.exe" called "CreateProcessA" with parameter "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" - (UID: 00000000-00008104)2f:T2a80,"SELECT * FROM Products" (Source: PROFORMA INVOICE.pdf, Indicator: "select * from products") "INSERT INTO [dbo].[Products] ([ProductName], [SupplierID], [CategoryID], [QuantityPerUnit], [UnitPrice], [UnitsInStock], [UnitsOnOrder], [ReorderLevel], [Discontinued]) VALUES (@ProductName, @SupplierID, @CategoryID, @QuantityPerUnit, @UnitPrice, @UnitsInStock, @UnitsOnOrder, @ReorderLevel, @Discontinued);SELECT ProductID, ProductName, SupplierID, CategoryID, QuantityPerUnit, UnitPrice, UnitsInStock, UnitsOnOrder, ReorderLevel, Discontinued FROM Products WHERE (ProductID = SCOPE_IDENTITY())" (Source: PROFORMA INVOICE.pdf, Indicator: "insert into [dbo].[products] ([productname], [supplierid], [categoryid], [quantityperunit], [unitprice], [unitsinstock], [unitsonorder], [reorderlevel], [discontinued]) values (@productname, @supplierid, @categoryid, @quantityperunit, @unitprice, @unitsinstock, @unitsonorder, @reorderlevel, @discontinued);select productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from products where (productid = scope_identity())"), "SELECT ProductID ProductName SupplierID CategoryID QuantityPerUnit UnitPrice UnitsInStock UnitsOnOrder ReorderLevel Discontinued FROM dbo.Products" (Source: PROFORMA INVOICE.pdf, Indicator: "select productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from dbo.products"), "INSERT INTO [dbo].[Categories] ([CategoryName], [Description], [Picture]) VALUES (@CategoryName, @Description, @Picture);SELECT CategoryID CategoryName Description Picture FROM Categories WHERE (CategoryID = SCOPE_IDENTITY())" (Source: PROFORMA INVOICE.pdf, Indicator: "insert into [dbo].[categories] ([categoryname], [description], [picture]) values (@categoryname, @description, @picture);select categoryid categoryname description picture from categories where (categoryid = scope_identity())"), "SELECT CategoryID CategoryName Description Picture FROM dbo.Categories" (Source: PROFORMA INVOICE.pdf, Indicator: "select categoryid categoryname description picture from dbo.categories"), "DELETE FROM [dbo].[Products] WHERE (([ProductID] = @Original_ProductID) AND ([ProductName] = @Original_ProductName) AND ((@IsNull_SupplierID = 1 AND [SupplierID] IS NULL) OR ([SupplierID] = @Original_SupplierID)) AND ((@IsNull_CategoryID = 1 AND [CategoryID] IS NULL) OR ([CategoryID] = @Original_CategoryID)) AND ((@IsNull_QuantityPerUnit = 1 AND [QuantityPerUnit] IS NULL) OR ([QuantityPerUnit] = @Original_QuantityPerUnit)) AND ((@IsNull_UnitPrice = 1 AND [UnitPrice] IS NULL) OR ([UnitPrice] = @Original_UnitPrice)) AND ((@IsNull_UnitsInStock = 1 AND [UnitsInStock] IS NULL) OR ([UnitsInStock] = @Original_UnitsInStock)) AND ((@IsNull_UnitsOnOrder = 1 AND [UnitsOnOrder] IS NULL) OR ([UnitsOnOrder] = @Original_UnitsOnOrder)) AND ((@IsNull_ReorderLevel = 1 AND [ReorderLevel] IS NULL) OR ([ReorderLevel] = @Original_ReorderLevel)) AND ([Discontinued] = @Original_Discontinued))" (Source: 6000041-ProductsTableAdapter~InitAdapter, Indicator: "delete from [dbo].[products] where (([productid] = @original_productid) and ([productname] = @original_productname) and ((@isnull_supplierid = 1 and [supplierid] is null) or ([supplierid] = @original_supplierid)) and ((@isnull_categoryid = 1 and [categoryid] is null) or ([categoryid] = @original_categoryid)) and ((@isnull_quantityperunit = 1 and [quantityperunit] is null) or ([quantityperunit] = @original_quantityperunit)) and ((@isnull_unitprice = 1 and [unitprice] is null) or ([unitprice] = @original_unitprice)) and ((@isnull_unitsinstock = 1 and [unitsinstock] is null) or ([unitsinstock] = @original_unitsinstock)) and ((@isnull_unitsonorder = 1 and [unitsonorder] is null) or ([unitsonorder] = @original_unitsonorder)) and ((@isnull_reorderlevel = 1 and [reorderlevel] is null) or ([reorderlevel] = @original_reorderlevel)) and ([discontinued] = @original_discontinued))"), "INSERT INTO [dbo].[Products] ([ProductName], [SupplierID], [CategoryID], [QuantityPerUnit], [UnitPrice], [UnitsInStock], [UnitsOnOrder], [ReorderLevel], [Discontinued]) VALUES (@ProductName, @SupplierID, @CategoryID, @QuantityPerUnit, @UnitPrice, @UnitsInStock, @UnitsOnOrder, @ReorderLevel, @Discontinued);\nSELECT ProductID ProductName SupplierID CategoryID QuantityPerUnit UnitPrice UnitsInStock UnitsOnOrder ReorderLevel Discontinued FROM Products WHERE (ProductID = SCOPE_IDENTITY())" (Source: 6000041-ProductsTableAdapter~InitAdapter, Indicator: "insert into [dbo].[products] ([productname], [supplierid], [categoryid], [quantityperunit], [unitprice], [unitsinstock], [unitsonorder], [reorderlevel], [discontinued]) values (@productname, @supplierid, @categoryid, @quantityperunit, @unitprice, @unitsinstock, @unitsonorder, @reorderlevel, @discontinued);\nselect productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from products where (productid = scope_identity())"), "UPDATE [dbo].[Products] SET [ProductName] = @ProductName [SupplierID] = @SupplierID [CategoryID] = @CategoryID [QuantityPerUnit] = @QuantityPerUnit [UnitPrice] = @UnitPrice [UnitsInStock] = @UnitsInStock [UnitsOnOrder] = @UnitsOnOrder [ReorderLevel] = @ReorderLevel [Discontinued] = @Discontinued WHERE (([ProductID] = @Original_ProductID) AND ([ProductName] = @Original_ProductName) AND ((@IsNull_SupplierID = 1 AND [SupplierID] IS NULL) OR ([SupplierID] = @Original_SupplierID)) AND ((@IsNull_CategoryID = 1 AND [CategoryID] IS NULL) OR ([CategoryID] = @Original_CategoryID)) AND ((@IsNull_QuantityPerUnit = 1 AND [QuantityPerUnit] IS NULL) OR ([QuantityPerUnit] = @Original_QuantityPerUnit)) AND ((@IsNull_UnitPrice = 1 AND [UnitPrice] IS NULL) OR ([UnitPrice] = @Original_UnitPrice)) AND ((@IsNull_UnitsInStock = 1 AND [UnitsInStock] IS NULL) OR ([UnitsInStock] = @Original_UnitsInStock)) AND ((@IsNull_UnitsOnOrder = 1 AND [UnitsOnOrder] IS NULL) OR ([UnitsOnOrder] = @Original_UnitsOnOrder)) AND ((@IsNull_ReorderLevel = 1 AND [ReorderLevel] IS NULL) OR ([ReorderLevel] = @Original_ReorderLevel)) AND ([Discontinued] = @Original_Discontinued));\nSELECT ProductID ProductName SupplierID CategoryID QuantityPerUnit UnitPrice UnitsInStock UnitsOnOrder ReorderLevel Discontinued FROM Products WHERE (ProductID = @ProductID)" (Source: 6000041-ProductsTableAdapter~InitAdapter, Indicator: "update [dbo].[products] set [productname] = @productname [supplierid] = @supplierid [categoryid] = @categoryid [quantityperunit] = @quantityperunit [unitprice] = @unitprice [unitsinstock] = @unitsinstock [unitsonorder] = @unitsonorder [reorderlevel] = @reorderlevel [discontinued] = @discontinued where (([productid] = @original_productid) and ([productname] = @original_productname) and ((@isnull_supplierid = 1 and [supplierid] is null) or ([supplierid] = @original_supplierid)) and ((@isnull_categoryid = 1 and [categoryid] is null) or ([categoryid] = @original_categoryid)) and ((@isnull_quantityperunit = 1 and [quantityperunit] is null) or ([quantityperunit] = @original_quantityperunit)) and ((@isnull_unitprice = 1 and [unitprice] is null) or ([unitprice] = @original_unitprice)) and ((@isnull_unitsinstock = 1 and [unitsinstock] is null) or ([unitsinstock] = @original_unitsinstock)) and ((@isnull_unitsonorder = 1 and [unitsonorder] is null) or ([unitsonorder] = @original_unitsonorder)) and ((@isnull_reorderlevel = 1 and [reorderlevel] is null) or ([reorderlevel] = @original_reorderlevel)) and ([discontinued] = @original_discontinued));\nselect productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from products where (productid = @productid)"), "DELETE FROM [dbo].[Categories] WHERE (([CategoryID] = @Original_CategoryID) AND ([CategoryName] = @Original_CategoryName))" (Source: 6000057-CategoriesTableAdapter~InitAdapter, Indicator: "delete from [dbo].[categories] where (([categoryid] = @original_categoryid) and ([categoryname] = @original_categoryname))"), "INSERT INTO [dbo].[Categories] ([CategoryName], [Description], [Picture]) VALUES (@CategoryName, @Description, @Picture);\nSELECT CategoryID CategoryName Description Picture FROM Categories WHERE (CategoryID = SCOPE_IDENTITY())" (Source: 6000057-CategoriesTableAdapter~InitAdapter, Indicator: "insert into [dbo].[categories] ([categoryname], [description], [picture]) values (@categoryname, @description, @picture);\nselect categoryid categoryname description picture from categories where (categoryid = scope_identity())"), "UPDATE [dbo].[Categories] SET [CategoryName] = @CategoryName [Description] = @Description [Picture] = @Picture WHERE (([CategoryID] = @Original_CategoryID) AND ([CategoryName] = @Original_CategoryName));\nSELECT CategoryID CategoryName Description Picture FROM Categories WHERE (CategoryID = @CategoryID)" (Source: 6000057-CategoriesTableAdapter~InitAdapter, Indicator: "update [dbo].[categories] set [categoryname] = @categoryname [description] = @description [picture] = @picture where (([categoryid] = @original_categoryid) and ([categoryname] = @original_categoryname));\nselect categoryid categoryname description picture from categories where (categoryid = @categoryid)"), "SELECT ProductID ProductName SupplierID CategoryID QuantityPerUnit UnitPrice UnitsInStock UnitsOnOrder ReorderLevel Discontinued FROM Products WHERE (ProductID = SCOPE_IDENTITY())" (Source: 00000000-00006424.00000000.68368.00B22000.00000002.mdmp, Indicator: "select productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from products where (productid = scope_identity())"), "SELECT ProductID ProductName SupplierID CategoryID QuantityPerUnit UnitPrice UnitsInStock UnitsOnOrder ReorderLevel Discontinued FROM Products WHERE (ProductID = @ProductID)" (Source: 00000000-00006424.00000000.68368.00B22000.00000002.mdmp, Indicator: "select productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from products where (productid = @productid)"), "SELECT CategoryID CategoryName Description Picture FROM Categories WHERE (CategoryID = SCOPE_IDENTITY())" (Source: 00000000-00006424.00000000.68368.00B22000.00000002.mdmp, Indicator: "select categoryid categoryname description picture from categories where (categoryid = scope_identity())"), "SELECT CategoryID CategoryName Description Picture FROM Categories WHERE (CategoryID = @CategoryID)" (Source: 00000000-00006424.00000000.68368.00B22000.00000002.mdmp, Indicator: "select categoryid categoryname description picture from categories where (categoryid = @categoryid)")30:T39f5,Found reference to API (Indicator: "GetObject"; File: "PROFORMA INVOICE.pdf") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp, 00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp, 00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp, 00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00002024.00000000.68746.00E81000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002024.00000000.68746.03380000.00000004.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp, 00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002024.00000000.68746.6EAD5000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00002024.00000000.68746.7F990000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00006424.00000000.68368.00B22000.00000002.mdmp, 00000000-00006424.00000000.68368.098B0000.00000004.mdmp, 00000000-00006424.00000000.68368.0C200000.00000004.mdmp")31:T163c,"SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 318-6-00E78190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 318-6-00E78190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 318-6-00E78190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 318-9-00E7BFA2 "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\PowerShell\Transcriptionptionf" in Source: 00000000-00002024.00000000.68746.00E28000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00002024.00000000.68746.00E71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00002024.00000000.68746.00E71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00002024.00000000.68746.00E71000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002024.00000000.68746.00E71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00002024.00000000.68746.00E71000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002024.00000000.68746.00E71000.00000020.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002024.00000000.68746.00FF0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002024.00000000.68746.03380000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002024.00000000.68746.03380000.00000004.mdmp "Y\MACHINE\SOFTWARE\Microsoft\Winttws" in Source: 00000000-00002024.00000000.68746.04ED8000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002024.00000000.68746.05110000.00000004.mdmp "E\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\C" in Source: 00000000-00002024.00000000.68746.07608000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default" in Source: 00000000-00002024.00000000.68746.07708000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.3.0.Microsoft.PowerShell.ConsoleHost.resources_en-US_31bf3856ad364e35" in Source: 00000000-00002024.00000000.68746.07708000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002024.00000000.68746.7F990000.00000002.mdmp32:T24a6,"SELECT * FROM Products" (Source: PROFORMA INVOICE.pdf, Indicator: "select * from products") "INSERT INTO [dbo].[Products] ([ProductName], [SupplierID], [CategoryID], [QuantityPerUnit], [UnitPrice], [UnitsInStock], [UnitsOnOrder], [ReorderLevel], [Discontinued]) VALUES (@ProductName, @SupplierID, @CategoryID, @QuantityPerUnit, @UnitPrice, @UnitsInStock, @UnitsOnOrder, @ReorderLevel, @Discontinued);SELECT ProductID, ProductName, SupplierID, CategoryID, QuantityPerUnit, UnitPrice, UnitsInStock, UnitsOnOrder, ReorderLevel, Discontinued FROM Products WHERE (ProductID = SCOPE_IDENTITY())" (Source: PROFORMA INVOICE.pdf, Indicator: "insert into [dbo].[products] ([productname], [supplierid], [categoryid], [quantityperunit], [unitprice], [unitsinstock], [unitsonorder], [reorderlevel], [discontinued]) values (@productname, @supplierid, @categoryid, @quantityperunit, @unitprice, @unitsinstock, @unitsonorder, @reorderlevel, @discontinued);select productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from products where (productid = scope_identity())"), "SELECT ProductID ProductName SupplierID CategoryID QuantityPerUnit UnitPrice UnitsInStock UnitsOnOrder ReorderLevel Discontinued FROM dbo.Products" (Source: PROFORMA INVOICE.pdf, Indicator: "select productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from dbo.products"), "INSERT INTO [dbo].[Categories] ([CategoryName], [Description], [Picture]) VALUES (@CategoryName, @Description, @Picture);SELECT CategoryID CategoryName Description Picture FROM Categories WHERE (CategoryID = SCOPE_IDENTITY())" (Source: PROFORMA INVOICE.pdf, Indicator: "insert into [dbo].[categories] ([categoryname], [description], [picture]) values (@categoryname, @description, @picture);select categoryid categoryname description picture from categories where (categoryid = scope_identity())"), "SELECT CategoryID CategoryName Description Picture FROM dbo.Categories" (Source: PROFORMA INVOICE.pdf, Indicator: "select categoryid categoryname description picture from dbo.categories"), "DELETE FROM [dbo].[Products] WHERE (([ProductID] = @Original_ProductID) AND ([ProductName] = @Original_ProductName) AND ((@IsNull_SupplierID = 1 AND [SupplierID] IS NULL) OR ([SupplierID] = @Original_SupplierID)) AND ((@IsNull_CategoryID = 1 AND [CategoryID] IS NULL) OR ([CategoryID] = @Original_CategoryID)) AND ((@IsNull_QuantityPerUnit = 1 AND [QuantityPerUnit] IS NULL) OR ([QuantityPerUnit] = @Original_QuantityPerUnit)) AND ((@IsNull_UnitPrice = 1 AND [UnitPrice] IS NULL) OR ([UnitPrice] = @Original_UnitPrice)) AND ((@IsNull_UnitsInStock = 1 AND [UnitsInStock] IS NULL) OR ([UnitsInStock] = @Original_UnitsInStock)) AND ((@IsNull_UnitsOnOrder = 1 AND [UnitsOnOrder] IS NULL) OR ([UnitsOnOrder] = @Original_UnitsOnOrder)) AND ((@IsNull_ReorderLevel = 1 AND [ReorderLevel] IS NULL) OR ([ReorderLevel] = @Original_ReorderLevel)) AND ([Discontinued] = @Original_Discontinued))" (Source: 6000041-ProductsTableAdapter~InitAdapter, Indicator: "delete from [dbo].[products] where (([productid] = @original_productid) and ([productname] = @original_productname) and ((@isnull_supplierid = 1 and [supplierid] is null) or ([supplierid] = @original_supplierid)) and ((@isnull_categoryid = 1 and [categoryid] is null) or ([categoryid] = @original_categoryid)) and ((@isnull_quantityperunit = 1 and [quantityperunit] is null) or ([quantityperunit] = @original_quantityperunit)) and ((@isnull_unitprice = 1 and [unitprice] is null) or ([unitprice] = @original_unitprice)) and ((@isnull_unitsinstock = 1 and [unitsinstock] is null) or ([unitsinstock] = @original_unitsinstock)) and ((@isnull_unitsonorder = 1 and [unitsonorder] is null) or ([unitsonorder] = @original_unitsonorder)) and ((@isnull_reorderlevel = 1 and [reorderlevel] is null) or ([reorderlevel] = @original_reorderlevel)) and ([discontinued] = @original_discontinued))"), "INSERT INTO [dbo].[Products] ([ProductName], [SupplierID], [CategoryID], [QuantityPerUnit], [UnitPrice], [UnitsInStock], [UnitsOnOrder], [ReorderLevel], [Discontinued]) VALUES (@ProductName, @SupplierID, @CategoryID, @QuantityPerUnit, @UnitPrice, @UnitsInStock, @UnitsOnOrder, @ReorderLevel, @Discontinued);\nSELECT ProductID ProductName SupplierID CategoryID QuantityPerUnit UnitPrice UnitsInStock UnitsOnOrder ReorderLevel Discontinued FROM Products WHERE (ProductID = SCOPE_IDENTITY())" (Source: 6000041-ProductsTableAdapter~InitAdapter, Indicator: "insert into [dbo].[products] ([productname], [supplierid], [categoryid], [quantityperunit], [unitprice], [unitsinstock], [unitsonorder], [reorderlevel], [discontinued]) values (@productname, @supplierid, @categoryid, @quantityperunit, @unitprice, @unitsinstock, @unitsonorder, @reorderlevel, @discontinued);\nselect productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from products where (productid = scope_identity())"), "UPDATE [dbo].[Products] SET [ProductName] = @ProductName [SupplierID] = @SupplierID [CategoryID] = @CategoryID [QuantityPerUnit] = @QuantityPerUnit [UnitPrice] = @UnitPrice [UnitsInStock] = @UnitsInStock [UnitsOnOrder] = @UnitsOnOrder [ReorderLevel] = @ReorderLevel [Discontinued] = @Discontinued WHERE (([ProductID] = @Original_ProductID) AND ([ProductName] = @Original_ProductName) AND ((@IsNull_SupplierID = 1 AND [SupplierID] IS NULL) OR ([SupplierID] = @Original_SupplierID)) AND ((@IsNull_CategoryID = 1 AND [CategoryID] IS NULL) OR ([CategoryID] = @Original_CategoryID)) AND ((@IsNull_QuantityPerUnit = 1 AND [QuantityPerUnit] IS NULL) OR ([QuantityPerUnit] = @Original_QuantityPerUnit)) AND ((@IsNull_UnitPrice = 1 AND [UnitPrice] IS NULL) OR ([UnitPrice] = @Original_UnitPrice)) AND ((@IsNull_UnitsInStock = 1 AND [UnitsInStock] IS NULL) OR ([UnitsInStock] = @Original_UnitsInStock)) AND ((@IsNull_UnitsOnOrder = 1 AND [UnitsOnOrder] IS NULL) OR ([UnitsOnOrder] = @Original_UnitsOnOrder)) AND ((@IsNull_ReorderLevel = 1 AND [ReorderLevel] IS NULL) OR ([ReorderLevel] = @Original_ReorderLevel)) AND ([Discontinued] = @Original_Discontinued));\nSELECT ProductID ProductName SupplierID CategoryID QuantityPerUnit UnitPrice UnitsInStock UnitsOnOrder ReorderLevel Discontinued FROM Products WHERE (ProductID = @ProductID)" (Source: 6000041-ProductsTableAdapter~InitAdapter, Indicator: "update [dbo].[products] set [productname] = @productname [supplierid] = @supplierid [categoryid] = @categoryid [quantityperunit] = @quantityperunit [unitprice] = @unitprice [unitsinstock] = @unitsinstock [unitsonorder] = @unitsonorder [reorderlevel] = @reorderlevel [discontinued] = @discontinued where (([productid] = @original_productid) and ([productname] = @original_productname) and ((@isnull_supplierid = 1 and [supplierid] is null) or ([supplierid] = @original_supplierid)) and ((@isnull_categoryid = 1 and [categoryid] is null) or ([categoryid] = @original_categoryid)) and ((@isnull_quantityperunit = 1 and [quantityperunit] is null) or ([quantityperunit] = @original_quantityperunit)) and ((@isnull_unitprice = 1 and [unitprice] is null) or ([unitprice] = @original_unitprice)) and ((@isnull_unitsinstock = 1 and [unitsinstock] is null) or ([unitsinstock] = @original_unitsinstock)) and ((@isnull_unitsonorder = 1 and [unitsonorder] is null) or ([unitsonorder] = @original_unitsonorder)) and ((@isnull_reorderlevel = 1 and [reorderlevel] is null) or ([reorderlevel] = @original_reorderlevel)) and ([discontinued] = @original_discontinued));\nselect productid productname supplierid categoryid quantityperunit unitprice unitsinstock unitsonorder reorderlevel discontinued from products where (productid = @productid)"), "DELETE FROM [dbo].[Categories] WHERE (([CategoryID] = @Original_CategoryID) AND ([CategoryName] = @Original_CategoryName))" (Source: 6000057-CategoriesTableAdapter~InitAdapter, Indicator: "delete from [dbo].[categories] where (([categoryid] = @original_categoryid) and ([categoryname] = @original_categoryname))"), "INSERT INTO [dbo].[Categories] ([CategoryName], [Description], [Picture]) VALUES (@CategoryName, @Description, @Picture);\nSELECT CategoryID CategoryName Description Picture FROM Categories WHERE (CategoryID = SCOPE_IDENTITY())" (Source: 6000057-CategoriesTableAdapter~InitAdapter, Indicator: "insert into [dbo].[categories] ([categoryname], [description], [picture]) values (@categoryname, @description, @picture);\nselect categoryid categoryname description picture from categories where (categoryid = scope_identity())"), "UPDATE [dbo].[Categories] SET [CategoryName] = @CategoryName [Description] = @Description [Picture] = @Picture WHERE (([CategoryID] = @Original_CategoryID) AND ([CategoryName] = @Original_CategoryName));\nSELECT CategoryID CategoryName Description Picture FROM Categories WHERE (CategoryID = @CategoryID)" (Source: 6000057-CategoriesTableAdapter~InitAdapter, Indicator: "update [dbo].[categories] set [categoryname] = @categoryname [description] = @description [picture] = @picture where (([categoryid] = @original_categoryid) and ([categoryname] = @original_categoryname));\nselect categoryid categoryname description picture from categories where (categoryid = @categoryid)")33:Ta79,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp")34:T196b,"PROFORMAINVOICE.pdf.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "PROFORMAINVOICE.pdf.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "PROFORMAINVOICE.pdf.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "PROFORMAINVOICE.pdf.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "PROFORMAINVOICE.pdf.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "PROFORMAINVOICE.pdf.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "PROFORMAINVOICE.pdf.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "PROFORMAINVOICE.pdf.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "PROFORMAINVOICE.pdf.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "PROFORMAINVOICE.pdf.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "PROFORMAINVOICE.pdf.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "PROFORMAINVOICE.pdf.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "RegSvcs.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "RegSvcs.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32")35:T920,"PROFORMA INVOICE.pdf" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "yhKpVNQhndht.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"36:T581,Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006424-00000BC0-40012286] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006424-00000C41-13624048026] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\PROFORMAINVOICE.pdf.exe"" [Source: 00000000-00006424-00000C41-13624048026] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "%APPDATA%\yhKp" [Source: 00000000-00006424-00000C41-13994617998], Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00006424-00000C41-14306368950], Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\yhKpVNQhndht" /XML "%TEMP%\tmp5054.tmp"" [Source: 00000000-00006424-00000C41-14306368950], Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" [Source: 00000000-00006424-00000C40-17801534018], Observed system executable string:"%WINDIR%\SysWOW64\schtasks.exe" [Source: 00000000-00008104-00000BC0-190572270], Observed system executable string:""%WINDIR%\System32\schtasks.exe" /Create /TN "Updates\yhKpVNQhndht" /XML "%TEMP%\tmp9B6D.tmp"" [Source: 00000000-00008104-00000C41-8245422180]37:T80e,"PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "PROFORMAINVOICE.pdf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")38:T4bc,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: yhKpVNQhndht.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: yhKpVNQhndht.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: yhKpVNQhndht.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: yhKpVNQhndht.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006424-00000C28-903502966]39:T424,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\\PROFORMAINVOICE.pdf.exe"" (UID: 00000000-00007832) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\yhKpVNQhndht.exe"" (UID: 00000000-00002024) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\yhKpVNQhndht" /XML "%TEMP%\\tmp5054.tmp"" (UID: 00000000-00006088) Spawned process "RegSvcs.exe" (UID: 00000000-00007228) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\yhKpVNQhndht.exe"" (UID: 00000000-00006456) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\yhKpVNQhndht.exe"" (UID: 00000000-00007896) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\yhKpVNQhndht" /XML "%TEMP%\\tmp9B6D.tmp"" (UID: 00000000-00006648) Spawned process "RegSvcs.exe" (UID: 00000000-00004168) Spawned process "RegSvcs.exe" (UID: 00000000-00002516) Spawned process "RegSvcs.exe" (UID: 00000000-00007988)3a:T424,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\\PROFORMAINVOICE.pdf.exe"" (UID: 00000000-00007832) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\yhKpVNQhndht.exe"" (UID: 00000000-00002024) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\yhKpVNQhndht" /XML "%TEMP%\\tmp5054.tmp"" (UID: 00000000-00006088) Spawned process "RegSvcs.exe" (UID: 00000000-00007228) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\yhKpVNQhndht.exe"" (UID: 00000000-00006456) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\\yhKpVNQhndht.exe"" (UID: 00000000-00007896) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\\yhKpVNQhndht" /XML "%TEMP%\\tmp9B6D.tmp"" (UID: 00000000-00006648) Spawned process "RegSvcs.exe" (UID: 00000000-00004168) Spawned process "RegSvcs.exe" (UID: 00000000-00002516) Spawned process "RegSvcs.exe" (UID: 00000000-00007988)3b:T439,"PROFORMAINVOICE.pdf.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp5054.tmp" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_oviy0d2r.frj.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fko3l2yr.z54.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qhdtkh1p.tip.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_zlzeol3p.h5x.psm1" "yhKpVNQhndht.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp9B6D.tmp" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_3k0ji3rr.bso.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_is33blfs.wnb.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_vgq1megc.tlv.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_aam5wcfy.ylj.psm1"3c:T704,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp")3d:T55f,"yhKpVNQhndht.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\yhKpVNQhndht.exe]- [targetUID: 00000000-00006424] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00007832] "PROFORMAINVOICE.pdf.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\PROFORMAINVOICE.pdf.exe.log]- [targetUID: 00000000-00006424] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007832] "tmp9B6D.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmp9B6D.tmp]- [targetUID: 00000000-00006648] "yhKpVNQhndht.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "yhKpVNQhndht.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "yhKpVNQhndht.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\yhKpVNQhndht.exe.log]- [targetUID: 00000000-00008104] "tmp5054.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmp5054.tmp]- [targetUID: 00000000-00006088]3e:T5ff,"PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "")3f:Tb48,"PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "PROFORMAINVOICE.PDF.EXE"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "PROFORMAINVOICE.pdf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "")40:Td59,"PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\CRYPTSP.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\DWRITE.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINDOWSCODECS.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\X86\SLC.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\X86\SPPC.DLL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\NTDLL.DLL"41:T8bf,"PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\PROFORMAINVOICE.PDF.EXE.CONFIG" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PROFORMAINVOICE.PDF.EXE.LOG" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\JTRL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\PROFORMAINVOICE.PDF.INI" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\PROFORMAINVOICE.PDF.EXE.LOCAL" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\ACCESSIBILITY" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\ACCESSIBILITY.INI" "PROFORMAINVOICE.pdf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DATA"42:T714,"PROFORMAINVOICE.pdf.exe" writes file "c:\users\%osuser%\appdata\roaming\yhkpvnqhndht.exe" "PROFORMAINVOICE.pdf.exe" writes file "c:\users\%osuser%\appdata\roaming\yhkpvnqhndht.exe:zone.identifier" "PROFORMAINVOICE.pdf.exe" writes file "c:\users\%osuser%\appdata\local\temp\tmp5054.tmp" "PROFORMAINVOICE.pdf.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\proformainvoice.pdf.exe.log" "PROFORMAINVOICE.pdf.exe" writes file "%appdata%\yhkpvnqhndht.exe:zone.identifier" "PROFORMAINVOICE.pdf.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\proformainvoice.pdf.exe.log" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_oviy0d2r.frj.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_fko3l2yr.z54.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_qhdtkh1p.tip.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_zlzeol3p.h5x.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\powershell.exe.log" "yhKpVNQhndht.exe" writes file "c:\users\%osuser%\appdata\local\temp\tmp9b6d.tmp" "yhKpVNQhndht.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\yhkpvnqhndht.exe.log" "yhKpVNQhndht.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\yhkpvnqhndht.exe.log" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_3k0ji3rr.bso.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_is33blfs.wnb.psm1"43:T18d0,Heuristic match: "6C.lT" Pattern match: "http://tempuri.org/DataSet1.xsd" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "http://www.w3.org/2001/XMLSchema" Heuristic match: "api.ipify.org" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ls@.ls" Pattern match: "http://www.microsoft.com0" Heuristic match: "uP.au" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/Microsoft.PowerShell" Heuristic match: "Set-Location $MyInvocation.MyCommand.Name" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225750" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225747" Heuristic match: "Get-Content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=113316" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=160712" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/Microsoft.PowerShell.ConsoleHost/v4.0_3.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.ConsoleHost.dll" Heuristic match: "ntrust.net" Heuristic match: "C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft.PowerShell.Co" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/CPS" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/windows0" Heuristic match: "## All the types of access rights understood by .NET" Pattern match: "www.microsojVU" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "tempuri.org/DataSet1.xsd"44:T7244,Found URL "http://www.microsoft.com0h" - Source: "00000000-00002024.00000000.68746.03380000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8e:r" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%y2.5.29.10" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/1.2.840.10045.2.1cth" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002024.00000000.68746.03580000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002024.00000000.68746.03580000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002024.00000000.68746.03580000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://www.microsoft.com0h" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>pot\?azhpx,q?azh?azh?azh?azhqt$" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>2.5.4.102.5.4.112.5.4.5xszd2zy6?mxszd2z*dpcz2.5.4.6929t2.5.4.82.5.4.71http://www.microsojvupat\t]klwashington1redmond1microsoft" - Source: "00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002024.00000000.68746.6EAC1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006424.00000000.68368.03190000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json09/24" - Source: "00000000-00006424.00000000.68368.07910000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,009/24" - Source: "00000000-00006424.00000000.68368.07910000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00006424.00000000.68368.084C0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006424.00000000.68368.6E531000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006424.00000000.68368.6E531000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00006424.00000000.68368.6E531000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006424.00000000.68368.6E5D1000.00000020.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006456.00000000.78359.00660000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006456.00000000.78359.00660000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006456.00000000.78359.00660000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006456.00000000.78359.00660000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006456.00000000.78359.00660000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwwvxpwv0l1" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ewashington1redmond1microsoft" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://www.microsoft.com0h" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;-v;^odigicert" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0verisign," - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006456.00000000.78359.0073B000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006456.00000000.78359.00910000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006456.00000000.78359.00910000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00006456.00000000.78359.04830000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00006456.00000000.78359.06D20000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006456.00000000.78359.06D20000.00000004.mdmp") Found URL "http://www.microsoft.com0h" - Source: "00000000-00006456.00000000.78359.06D20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.micro+r/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00006456.00000000.78359.06D20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0&pj>e" - Source: "00000000-00006456.00000000.78359.06D20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006456.00000000.78359.06D20000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006456.00000000.78359.71891000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007832.00000000.68729.6EAC1000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/p.q4khoz&waz&wo1bu0t&w@z&w@z&w" - Source: "00000000-00007896.00000000.78365.00810000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%yptu)putsigneddatamsgappxsipputsigneddatamsgp7xsipputsigneddatamsgsystem.management.dllessmlhistorydecodeexputsigneddatamsgessreceiptdecodeexesdsipputsignatureesscontenthintdecodeexmsisipputsigneddatamsgldapprovopenstoreputsigneddatamsgldapprovopenstoresystem.management.dllus1)0'" - Source: "00000000-00007896.00000000.78365.00810000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007896.00000000.78365.008EF000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007896.00000000.78365.008EF000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007896.00000000.78365.00A30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007896.00000000.78365.00A30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0digicert" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_201kzpton1redmond1microsoft" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007896.00000000.78365.06DD0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007896.00000000.78365.71891000.00000020.mdmp")45:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp")46:Ta74,"PROFORMAINVOICE.pdf.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00006424) "PROFORMAINVOICE.pdf.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006424)47:Tac5,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.00E71000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002024.00000000.68746.03380000.00000004.mdmp, 00000000-00002024.00000000.68746.0345A000.00000004.mdmp, 00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002024.00000000.68746.0345A000.00000004.mdmp, 00000000-00002024.00000000.68746.07920000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00002024.00000000.68746.05110000.00000004.mdmp") Found string "[-WindowStyle