26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 61:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.CoinMiner.bot Sample 021fc7bfa60f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 021fc7bfa60f…. Malware family: Trojan.CoinMiner.bot. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","keywords":["Malicious","Trojan.CoinMiner.bot","malware analysis","sandbox report","threat intelligence","021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc"],"about":{"@type":"SoftwareApplication","name":"轰炸机器人客户端.exe","applicationCategory":["compressed","7zip"],"identifier":"021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.CoinMiner.bot","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2c7d,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueA"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "SetClassLongA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuA"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "DrawTextA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileA"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathA"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityA"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectA"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "LoadBitmapA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")28:T735,Found reference string "cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; Source: "00000000-00004288-00000C46-17311250482") Found reference string "cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; Source: "00000000-00003420-00000C47-907813802") Found reference string "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\" (Indicator: "add-mppreference"; Source: "00000000-00002108-00000C47-891831806") Found reference string "Add-MpPreference -ExclusionPath C:\,D:\,F:\" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "/C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "/C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; File: "cmd.exe") Found reference string "md.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; Source: "00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found reference string ".exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" (Indicator: "add-mppreference"; Source: "00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found reference string "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\" (Indicator: "add-mppreference"; Source: "00000000-00007824.00000000.152000.03140000.00000004.mdmp, 00000000-00007824.00000001.153519.03140000.00000004.mdmp") Found reference string "HostApplication=powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\" (Indicator: "add-mppreference"; Source: "00000000-00007824.00000001.153519.031B6000.00000004.mdmp, 00000000-00007824.00000001.153519.085E1000.00000004.mdmp")29:T581,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00005176.00000000.152411.00401000.00000080.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00005176.00000000.152411.00401000.00000080.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/CONNECT %s:%d HTTP/1.1" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/CONNECT %s:%d HTTP/1.1" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005176.00000000.152411.00508000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005176.00000000.152411.00508000.00000004.mdmp")2a:T9c2,"tasklist.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\PROGID") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{9556DC99-828C-11CF-A37E-00AA003240C7}") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9556DC99-828C-11CF-A37E-00AA003240C7}") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{9556DC99-828C-11CF-A37E-00AA003240C7}\PROXYSTUBCLSID32") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9556DC99-828C-11CF-A37E-00AA003240C7}\PROXYSTUBCLSID32") "tasklist.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9556DC99-828C-11CF-A37E-00AA003240C7}\PROXYSTUBCLSID32") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9556DC99-828C-11CF-A37E-00AA003240C7}\PROXYSTUBCLSID32") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "tasklist.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32")2b:T977,"_.exe" queried SystemProcessInformation at 00000000-00004288-00000C15-708276279 [PID: 4288] "_.exe" queried SystemProcessInformation at 00000000-00004288-00000C15-708283813 [PID: 4288] "_.exe" queried SystemProcessInformation at 00000000-00004288-00000C15-708463411 [PID: 4288] "_.exe" queried SystemProcessInformation at 00000000-00004288-00000C15-708470601 [PID: 4288] "_.exe" queried SystemProcessInformation at 00000000-00004288-00000C15-708681653 [PID: 4288] "_.exe" queried SystemProcessInformation at 00000000-00004288-00000C15-708689397 [PID: 4288] "cmd.exe" queried SystemProcessInformation at 00000000-00008704-00000C15-709909520 [PID: 8704] "cmd.exe" queried SystemProcessInformation at 00000000-00008704-00000C15-709920976 [PID: 8704] "cmd.exe" queried SystemProcessInformation at 00000000-00008704-00000C15-710102056 [PID: 8704] "cmd.exe" queried SystemProcessInformation at 00000000-00008704-00000C15-710109791 [PID: 8704] "tasklist.exe" queried SystemProcessInformation at 00000000-00007812-00000C15-710637857 [PID: 7812] "tasklist.exe" queried SystemProcessInformation at 00000000-00007812-00000C15-710648990 [PID: 7812] "tasklist.exe" queried SystemProcessInformation at 00000000-00007812-00000C15-710812822 [PID: 7812] "tasklist.exe" queried SystemProcessInformation at 00000000-00007812-00000C15-710820264 [PID: 7812] "tasklist.exe" queried SystemProcessInformation at 00000000-00007812-00000C15-711058528 [PID: 7812] "tasklist.exe" queried SystemProcessInformation at 00000000-00007812-00000C15-711066036 [PID: 7812] "cmd.exe" queried SystemProcessInformation at 00000000-00003420-00000C15-715805628 [PID: 3420] "cmd.exe" queried SystemProcessInformation at 00000000-00003420-00000C15-715813652 [PID: 3420] "cmd.exe" queried SystemProcessInformation at 00000000-00003420-00000C15-716008564 [PID: 3420] "cmd.exe" queried SystemProcessInformation at 00000000-00003420-00000C15-716015633 [PID: 3420] "cmd.exe" queried SystemProcessInformation at 00000000-00002108-00000C15-716458871 [PID: 2108] "cmd.exe" queried SystemProcessInformation at 00000000-00002108-00000C15-716466064 [PID: 2108] "cmd.exe" queried SystemProcessInformation at 00000000-00002108-00000C15-716644331 [PID: 2108] "cmd.exe" queried SystemProcessInformation at 00000000-00002108-00000C15-716651363 [PID: 2108] "powershell.exe" queried SystemProcessInformation at 00000000-00007824-00000C15-717397368 [PID: 7824]2c:T659,"_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ev2f79.exe.nhpart_48f89964d4ab" to "%APPDATA%\comain_ev2f79\ev2f79.exe" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ntrin.er.nhpart_5629f3e0a1ed" to "%APPDATA%\comain_ev2f79\ntrin.er" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\otrm.oi.nhpart_71a9a329e4b4" to "%APPDATA%\comain_ev2f79\otrm.oi" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\yinma.vc.nhpart_fb26a3da266f" to "%APPDATA%\comain_ev2f79\yinma.vc" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\dxyvnb.ti.nhpart_3209290f3a4e" to "%APPDATA%\comain_ev2f79\dxyvnb.ti" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\ev2c34.exe.nhpart_8200df9dbca5" to "%APPDATA%\comain_ev2c34\ev2c34.exe" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\bnymir.ou.nhpart_aba42f2cdfff" to "%APPDATA%\comain_ev2c34\bnymir.ou" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\bteuns.pt.nhpart_1cdda6b5f709" to "%APPDATA%\comain_ev2c34\bteuns.pt" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\cmrsk.ce.nhpart_995a8954d15f" to "%APPDATA%\comain_ev2c34\cmrsk.ce" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\fhkan.oi.nhpart_9c9d6820913a" to "%APPDATA%\comain_ev2c34\fhkan.oi" "_.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\ap.asin.nhpart_db6dd1863c61" to "%APPDATA%\comain_ev2c34\ap.asin"2d:T1634,Found api reference "bcrypt::BCryptOpenAlgorithmProvider(*p .R0, w "SHA256", p 0, i 8) i .R6" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptGetProperty(p R0, w "ObjectLength", *i .R6, i 4, *i .R7, i 0) i .R8" (Indicator: "BCryptGetProperty"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptCreateHash(p R0, *p .R2, p R1, i R6, p r4, i 32, i 0) i .R8" (Indicator: "BCryptCreateHash"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptCreateHash(p R0, *p .R2, p R1, i R6, p r4, i 32, i 0) i .R8" (Indicator: "CryptCreateHash"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptHashData(p R2, p r5, i 64, i 0) i .R8" (Indicator: "BCryptHash"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptHashData(p R2, p r5, i 64, i 0) i .R8" (Indicator: "BCryptHashData"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptHashData(p R2, p r5, i 64, i 0) i .R8" (Indicator: "CryptHashData"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptHashData(p R2, p r6, i R6, i 0) i .R8" (Indicator: "BCryptHash"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptHashData(p R2, p r6, i R6, i 0) i .R8" (Indicator: "BCryptHashData"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptHashData(p R2, p r6, i R6, i 0) i .R8" (Indicator: "CryptHashData"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptFinishHash(p R2, p r7, i 32, i 0) i .R8" (Indicator: "BCryptFinishHash"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptDestroyHash(p R2) i .R6" (Indicator: "BCryptDestroyHash"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptDestroyHash(p R2) i .R6" (Indicator: "CryptDestroyHash"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptCloseAlgorithmProvider(p R0, i 0) i .R6" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptOpenAlgorithmProvider(*p .R0, w "AES", p 0, i 0) i .R6" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptSetProperty(p R0, w "ChainingMode", w "ChainingModeCBC", i 32, i 0) i .R6" (Indicator: "BCryptSetProperty"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptGenerateSymmetricKey(p R0, *p .R2, p R1, i R6, p r3, i 32, i 0) i .R8" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptDecrypt(p R2, p r6, i R8, p 0, p R3, i 16, p r7, i 1048576, *i .R7, i R9) i .R6" (Indicator: "BCryptDecrypt"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptDecrypt(p R2, p r6, i R8, p 0, p R3, i 16, p r7, i 1048576, *i .R7, i R9) i .R6" (Indicator: "CryptDecrypt"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptDestroyKey(p R2) i .R6" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "bcrypt::BCryptDestroyKey(p R2) i .R6" (Indicator: "CryptDestroyKey"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00005176.00000000.152411.006A0000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00005176.00000000.152411.006A0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00005176.00000000.152411.006A0000.00000004.mdmp")2e:T95b,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004288-00000C2C-717220265") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004288-00000C2C-717261845") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004288-00000C2C-717278288") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004288-00000C2C-717282112") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004288-00000C2C-717336980") Found reference to API "bcrypt::BCryptOpenAlgorithmProvider(*p .R0, w "SHA256", p 0, i 8) i .R6" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found reference to API "bcrypt::BCryptCloseAlgorithmProvider(p R0, i 0) i .R6" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found reference to API "bcrypt::BCryptOpenAlgorithmProvider(*p .R0, w "AES", p 0, i 0) i .R6" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found reference to API "bcrypt::BCryptGenerateSymmetricKey(p R0, *p .R2, p R1, i R6, p r3, i 32, i 0) i .R8" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found reference to API "bcrypt::BCryptDecrypt(p R2, p r6, i R8, p 0, p R3, i 16, p r7, i 1048576, *i .R7, i R9) i .R6" (Indicator: "BCryptDecrypt"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found reference to API "bcrypt::BCryptDestroyKey(p R2) i .R6" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004288.00000001.152147.009C0000.00000004.mdmp")2f:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCHnmKbck0ySOYBbtr7gcHQVsdIM0PxB7sZ2FyCQLdcFaCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420879e629b724d3248e6016edafb81c1d056c7483343f107bb19d85c8240b75c15a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"}30:T138f,Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007812-36445-204-00C2E548 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007812-36445-204-00C2E548 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-205-00C2A0DF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-205-00C2A0DF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-212-00C2DC09 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-212-00C2DC09 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-217-00C28F20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-217-00C28F20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-230-00C2D662 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-230-00C2D662 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-231-00C2C96B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-231-00C2C96B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-235-00C29FE2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-235-00C29FE2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-238-00C2CC83 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-238-00C2CC83 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-282-00C2B14E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-282-00C2B14E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-285-00C2B2AB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-285-00C2B2AB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-286-00C2B1F8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-286-00C2B1F8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-303-00C2A959 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-303-00C2A959 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-306-00C2D95B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-306-00C2D95B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-307-00C2D432 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-307-00C2D432 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-308-00C2D0E6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-308-00C2D0E6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-310-00C2CF22 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-310-00C2CF22 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-311-00C2CDE4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-311-00C2CDE4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-314-00C21F89 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-329-00C299B5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-329-00C299B5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-331-00C226BA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-331-00C226BA Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00007812-36445-334-00C2F185 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00007812-36445-334-00C2F185 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00007812-36445-334-00C2F185 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00007812-36445-334-00C2F185 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00007812-36445-334-00C2F185 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-341-00C26740 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-341-00C26740 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007812-36445-348-00C2364E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007812-36445-348-00C2364E Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00007812-36445-461-00C2F8D8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007824-58821-73-0045FF70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007824-58821-73-0045FF7031:T4df,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption32:T60ad,Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1271227; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1310715; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1850180; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1915602; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1965112; code bytes = 30d0 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 144553; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 589716; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 590337; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 836857; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 987952; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 987970; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 987986; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1144281; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1290476; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1618293; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1618741; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1619317; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1619765; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1888169; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1930173; code bytes = 33c1 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 13651; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 74835; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 291644; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 715539; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 984952; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 984979; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 985010; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 985027; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1217419; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1269004; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1270672; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1271207; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1271226; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1271412; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1271500; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1271671; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1271682; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1272203; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1272214; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1272666; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1272677; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1273750; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1275066; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1275077; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1275888; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1275909; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1276191; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1276202; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1276212; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1276379; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1276390; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1276542; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1276703; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1276714; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1277309; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1277526; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1278466; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1279512; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1279859; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1280264; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1280275; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1280459; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1280470; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1280600; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1280868; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1280879; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1281103; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1281114; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1281380; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1281448; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1281702; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1282541; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1282799; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1282993; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1283311; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1283755; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1283977; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1284109; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1284256; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1284363; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1284671; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1285283; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1285369; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1285380; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1285861; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1286197; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1286427; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1286654; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1286707; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1287106; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1287397; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1287582; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1289198; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1289870; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1290246; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1290465; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1290711; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1291075; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1291255; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1291387; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1291604; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1291801; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1292150; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1292683; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1293425; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1293955; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1294335; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1294755; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1294780; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1295454; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1295480; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1296214; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1296225; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1296391; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1296469; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1296499; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1296606; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1296740; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1296751; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1297454; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1297753; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1298102; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1298716; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1298959; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1299231; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1299599; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1300364; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1300649; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1301547; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1301932; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1302272; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1303094; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1303394; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1303875; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1305014; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1305208; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1305574; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1306319; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1306365; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1306686; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1307183; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1307701; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308031; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308246; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308357; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308501; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308512; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308548; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308594; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308605; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308685; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308744; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308755; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308781; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308966; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1308994; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1309300; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1309308; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1309453; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1309461; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1309520; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1309536; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1309577; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1309940; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1310012; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1310788; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1310857; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1311051; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1311206; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1311434; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1311490; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1311737; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1311748; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1312076; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1312087; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1312140; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1312151; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1312201; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1312212; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1342154; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1348620; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1360970; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1711744; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 1722320; code bytes = 8030 Found XOR loop in file "ev2f79.exe.nhpart_48f89964d4ab" at offset 2022490; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 368355; code bytes = 30d0 Found XOR loop in file "Snipaste Installer.exe" at offset 391048; code bytes = 30d0 Found XOR loop in file "Snipaste Installer.exe" at offset 407857; code bytes = 30d0 Found XOR loop in file "Snipaste Installer.exe" at offset 431534; code bytes = 30d0 Found XOR loop in file "Snipaste Installer.exe" at offset 476247; code bytes = 30d0 Found XOR loop in file "Snipaste Installer.exe" at offset 1199858; code bytes = 30d0 Found XOR loop in file "Snipaste Installer.exe" at offset 1216667; code bytes = 30d0 Found XOR loop in file "Snipaste Installer.exe" at offset 1240344; code bytes = 30d0 Found XOR loop in file "Snipaste Installer.exe" at offset 427648; code bytes = 33c1 Found XOR loop in file "Snipaste Installer.exe" at offset 509915; code bytes = 33c1 Found XOR loop in file "Snipaste Installer.exe" at offset 528728; code bytes = 33c1 Found XOR loop in file "Snipaste Installer.exe" at offset 1236458; code bytes = 33c1 Found XOR loop in file "Snipaste Installer.exe" at offset 43157; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 63127; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 106991; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 107167; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 107367; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 107511; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 109527; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 118367; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 171362; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 359320; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 410494; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 424732; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 507400; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 510754; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 527644; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 1219304; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 1233542; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 1266193; code bytes = 8030 Found XOR loop in file "Snipaste Installer.exe" at offset 1290559; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 991338; code bytes = 30d0 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 146003; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 146014; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 146413; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 146424; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 356734; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 357336; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 358222; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 358643; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 403295; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 685926; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 707441; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 708040; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 748116; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 755660; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 993045; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 993493; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 994069; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 994517; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 995253; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 995701; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 996277; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 996725; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 1145302; code bytes = 33c1 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 12338; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 12357; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 31162; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 31234; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 31279; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 89586; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 89666; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 89762; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 115266; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 117597; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 120763; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 121678; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 250482; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 563474; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 577586; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 579878; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 613410; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 613490; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 629860; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 633501; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 680085; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 680189; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 857625; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 895122; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 975468; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 987818; code bytes = 8030 Found XOR loop in file "ev2c34.exe.nhpart_8200df9dbca5" at offset 1179539; code bytes = 803033:T415,Found string "cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (Source: "00000000-00004288-00000C46-3274954192") Found string "%WINDIR%\SysWOW64\findstr.exe" (Source: "00000000-00008704-00000BC0-710426490") Found string "%WINDIR%\system32\findstr.exe" (Source: "00000000-00008704-00000C47-1278172102") Found string "findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (Source: "00000000-00008704-00000C47-1278172102") Found string "/C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (File: "cmd.exe") Found string "exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp") Found string "cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp") Found string "findstr.exe" (Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp, 00000000-00007812.00000000.151581.02E22000.00000004.mdmp, 00000000-00007812.00000000.151581.02E30000.00000004.mdmp")34:T2722,"_.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000004575201cbf63feffffff1cf319000200000080be8376609ee8740cf3190091be8376020000000000000058f319003b3c42750200000000000000f447e874000000009d1a4275841a4275903fe816f447e87405000000609ee87400000000ddafe9749c48ec74d0f31900d01f45756003bf63feffffff64f31900101a427540f3e97474f3190068cae974e044ec7440f3e97480f3190082cae97440f3e974a0f319006a9ee87440f3e97447ac4175010000000100000001000000f9c9e974e0f31900f0c0e97400000000b4c0e97415dc0dea0100000001000000000000000000000000000000b0f319005625557720f4190020c3e9742538f89efeffffff (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000030379c000100000064d61900a1005577700055779258e96164539176160155770000000000000000000000000000000000000000347f777600000000d0178e7634d4190000009c0000000000040000000000000064539176000000006453917601000000f0e09974cc978f76f0e0997438d69d000000000030d41900f0e099742d00770069006e002d0063006f00720065002d0069006e0084d4190093c59874bcbb9e00bcdf287a0000000050c5987409c69874c0bb9e00020000000000000000000000987880574f8c6244bb6371042380b1090000000000589d742c7b837400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000030379c000100000064d61900a1005577700055779258e96164539176160155770000000000000000000000000000000000000000347f777600000000d0178e7634d4190000009c0000000000040000000000000064539176000000006453917601000000f0e09974cc978f76f0e0997438d69d000000000030d41900f0e099742d00770069006e002d0063006f00720065002d0069006e0084d4190093c59874343c9f00bcdf287a0000000050c5987409c69874383c9f00020000000000000000000000987880574f8c6244bb6371042380b1090000000000589d742c7b837400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000030379c000100000064d61900a1005577700055779258e96164539176160155770000000000000000000000000000000000000000347f777600000000d0178e7634d4190000009c0000000000040000000000000064539176000000006453917601000000f0e09974cc978f76f0e0997438d69d000000000030d41900f0e099742d00770069006e002d0063006f00720065002d0069006e0084d4190093c598749c509f00bcdf287a0000000050c5987409c69874a0509f00020000000000000000000000987880574f8c6244bb6371042380b1090000000000589d742c7b837400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000030379c000100000064d61900a1005577700055779258e96164539176160155770000000000000000000000000000000000000000347f777600000000d0178e7634d4190000009c0000000000040000000000000064539176000000006453917601000000f0e09974cc978f76f0e0997438d69d000000000030d41900f0e099742d00770069006e002d0063006f00720065002d0069006e0084d4190093c59874d46c9f00bcdf287a0000000050c5987409c69874d86c9f00020000000000000000000000987880574f8c6244bb6371042380b1090000000000589d742c7b837400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000030379c000100000064d61900a1005577700055779258e96164539176160155770000000000000000000000000000000000000000347f777600000000d0178e7634d4190000009c0000000000040000000000000064539176000000006453917601000000f0e09974cc978f76f0e0997438d69d000000000030d41900f0e099742d00770069006e002d0063006f00720065002d0069006e0084d4190093c59874fc709f00bcdf287a0000000050c5987409c6987400719f00020000000000000000000000987880574f8c6244bb6371042380b1090000000000589d742c7b837400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000030379c000100000064d61900a1005577700055779258e96164539176160155770000000000000000000000000000000000000000347f777600000000d0178e7634d4190000009c0000000000040000000000000064539176000000006453917601000000f0e09974cc978f76f0e0997438d69d000000000030d41900f0e099742d00770069006e002d0063006f00720065002d0069006e0084d4190093c5987444749f00bcdf287a0000000050c5987409c6987448749f00020000000000000000000000987880574f8c6244bb6371042380b1090000000000589d742c7b837400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000190070b557777a4d9016feffffff80f5190000000000c8dd650290e56974f402650250f51900000000000000650250f51900a0e56974e4dd650201cc697408be9e00c8dd650264f5190044f5190090e56974c8dd65020000000010000000e867a77600000000d0f51900d0f51900a0e56974e4dd6502f3aa6974c0dd65020240008003ab697400000000c0dd650200000000b0e5697408be9e000000000000000000a0f519009e7be96198000000a0f5190038215677e4dd6502000000000000000008be9e0004000000c0dd650270dd6502c163af76becd3f660000000008be9e00c0dd650208be9e0008be9e00e867a776b4f51900f0f51900f0f61900 (UID: 00000000-00004288) "_.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004288) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008704) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008704) "tasklist.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007812) "tasklist.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007812) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003420)35:T5d2,"tasklist.exe" called "GetLocaleInfoW" with parameter "1024" - (UID: 00000000-00007812) "powershell.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00007824) "powershell.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00007824) "ev2f79.exe" called "GetLocaleInfoA" with parameter "1078" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "1118" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "14337" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "15361" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "5121" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "3073" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "2049" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "11265" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "13313" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "12289" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "4097" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "6145" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "8193" - (UID: 00000000-00008980) "ev2f79.exe" called "GetLocaleInfoA" with parameter "16385" - (UID: 00000000-00008980)36:T699,GetLocaleInfoW@KERNEL32.DLL at 00000000-00007812-36445-330-00C22201 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007824-58821-116-0045F012 GetLocaleInfoA@KERNEL32.DLL at 00000000-00008980-59893-11-004A311A GetLocaleInfoA@KERNEL32.DLL at 00000000-00008980-59893-14-004A3231 GetLocaleInfoA@KERNEL32.DLL at 00000000-00008980-59893-16-004A32C9 GetLocaleInfoA@KERNEL32.DLL at 00000000-00008980-59893-20-004A350F EnumSystemLocalesA@KERNEL32.DLL at 00000000-00008980-59893-21-004A3673 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00008980-59893-22-004A3635 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00008980-59893-23-004A35CE GetLocaleInfoW@KERNEL32.DLL at 00000000-00008980-59893-2175-004B3160 GetLocaleInfoW@KERNEL32.DLL at 00000000-00008980-59893-2178-004B40F0 GetLocaleInfoW@KERNEL32.DLL at 00000000-00008980-59893-2182-004B35F0 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00008980-59893-2185-004B37E0 GetLocaleInfoA@KERNEL32.DLL at 00000000-00008980-59893-2322-004A5D5B GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-64435-921-004C05ED GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-64435-3336-004A572E GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-64435-3369-004C1EB1 GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-64435-3412-004BE816 GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-64435-3413-004BE8F8 GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-64435-3416-004BE98E GetLocaleInfoA@KERNEL32.DLL at 00000000-00005176-64435-3419-004BEBD0 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005176-64435-4299-004BED30 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005176-64435-4300-004BECF4 EnumSystemLocalesA@KERNEL32.DLL at 00000000-00005176-64435-4301-004BEC8F37:T607,"_.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "_.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "ev2f79.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ev2c34.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")38:T4ab,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp, 00000000-00005176.00000000.152411.02590000.00000040.mdmp, 00000000-00005176.00000000.152411.1001B000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007812.00000000.151581.00C32000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007812.00000000.151581.00C32000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007824.00000001.153519.00462000.00000002.mdmp")39:T6b4,GetProcessHeap@KERNEL32.DLL at 00000000-00007812-36445-152-00C28AE0 GetProcessHeap@KERNEL32.DLL at 00000000-00007812-36445-153-00C2ADFA GetProcessHeap@KERNEL32.DLL at 00000000-00007812-36445-154-00C2AC2F GetProcessHeap@KERNEL32.DLL at 00000000-00007812-36445-169-00C2AC6A GetProcessHeap@KERNEL32.DLL at 00000000-00007812-36445-188-00C2AD14 OpenProcess@KERNEL32.DLL at 00000000-00007812-36445-256-00C24C58 OpenProcess@KERNEL32.DLL at 00000000-00007812-36445-268-00C24A62 OpenProcessToken@ADVAPI32.DLL at 00000000-00007812-36445-331-00C226BA OpenProcess@KERNEL32.DLL at 00000000-00007824-58821-163-00458EA0 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-80-00523480 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-81-005233D0 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-319-00520130 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-332-0051FC90 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-341-00510E50 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-350-004D3400 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-556-004E8FB0 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-645-00515B00 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-678-005139F0 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-699-0051ED20 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-823-0050E860 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-860-0050BA70 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-883-00508BD0 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-886-00508AC0 OpenProcessToken@ADVAPI32.DLL at 00000000-00008980-59893-921-004F5D00 GetProcessHeap@KERNEL32.DLL at 00000000-00008980-59893-932-00506B603a:T4e7,PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-452-004043D0 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-456-00403E90 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-911-004824F0 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-1846-00490ED0 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-1859-00489E50 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-1900-00428960 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-1908-0048FB90 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2012-00487E00 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2117-0043C2D0 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2129-0047FC40 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2154-0047E9E8 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2213-0047C2A0 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2373-0046BD40 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2380-0046A860 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2384-00428AC0 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2947-0043B860 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-2952-0043B113 PathFileExistsW@SHLWAPI.DLL at 00000000-00005176-64435-3131-0042EEA93b:T15a5,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00007824-00000C17-719903643 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00007824-00000C17-720061373 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007824-00000C17-724018608 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll" at 00000000-00007824-00000C17-725243198 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007824-00000C17-725251883 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00007824-00000C17-725482012 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00007824-00000C17-726339583 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007824-00000C17-726734935 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007824-00000C17-726975966 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007824-00000C17-726976247 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00007824-00000C17-728506366 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007824-00000C17-728560592 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007824-00000C17-728623765 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007824-00000C17-728624060 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007824-00000C17-729819937 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007824-00000C17-730968289 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007824-00000C17-731367223 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.5915.cat" at 00000000-00007824-00000C17-731598205 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.5794.cat" at 00000000-00007824-00000C17-731693802 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00007824-00000C17-731795997 "powershell.exe" queries volume information of "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00007824-00000C17-732232684 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007824-00000C17-732529065 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007824-00000C17-732541075 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007824-00000C17-732541436 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007824-00000C17-7327214523c:T4d6,Found string "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; File: "00000000-00007812.00000000.151581.00C21000.00000020.mdmp") Found string "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp, 00000000-00007812.00000000.151581.00C21000.00000020.mdmp, 00000000-00007812.00000000.151581.02E30000.00000004.mdmp") Found string "ECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00007812.00000000.151581.02E22000.00000004.mdmp") Found string "ExecQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process);" (Indicator: " Win32_Process"; Source: "00000000-00007812.00000000.151581.02E22000.00000004.mdmp") Found string "from win32_process" (Indicator: " Win32_Process"; Source: "00000000-00007812.00000000.151581.02E30000.00000004.mdmp")3d:T40c,"_.exe" called "CreateProcessA" with parameter "cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" - (UID: 00000000-00004288) "_.exe" called "CreateProcessA" with parameter "cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" - (UID: 00000000-00004288) "_.exe" called "CreateProcessA" with parameter ""%APPDATA%\comain_ev2f79\ev2f79.exe"" - (UID: 00000000-00004288) "_.exe" called "CreateProcessA" with parameter ""%APPDATA%\comain_ev2c34\ev2c34.exe"" - (UID: 00000000-00004288) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00008704) "cmd.exe" called "CreateProcessW" with parameter "findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" - (UID: 00000000-00008704) "cmd.exe" called "CreateProcessW" with parameter "cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\ D:\ F:\"" - (UID: 00000000-00003420) "cmd.exe" called "CreateProcessW" with parameter "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\" - (UID: 00000000-00002108)3e:T3902,"_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %TEMP%\nsuD41.tmp\nsExec.dll (UID: 00000000-00004288) "_.exe" called "LoadLibrary" with a parameter %TEMP%\nsuD41.tmp\System.dll (UID: 00000000-00004288) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00007812) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007812) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007812) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007812) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007812) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\416015a614fb5f5c53cd9ccbf0e5e13f\System.Xml.ni.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\0fc458e2e89a1743b9bb2c58049a8f4f\System.Configuration.ni.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007824) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007824) "ev2f79.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008980) "ev2f79.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008980) "ev2f79.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00008980) "ev2f79.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008980) "ev2f79.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008980) "ev2f79.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008980) "ev2c34.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Kernel32.dll (UID: 00000000-00005176) "ev2c34.exe" called "LoadLibrary" with a parameter zlib1.dll (UID: 00000000-00005176) "ev2c34.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005176) "ev2c34.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005176) "ev2c34.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005176) "ev2c34.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005176) "ev2c34.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005176) "ev2c34.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005176)3f:Td95c,"_.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter ExecToStack (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter Exec (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter Store (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter Alloc (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter Int64Op (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00004288) "_.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00004288) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008704) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008704) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008704) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008704) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008704) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008704) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008704) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008704) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007812) "tasklist.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007812) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003420) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003420) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003420) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003420) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003420) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003420) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003420) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003420) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002108) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002108) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002108) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002108) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002108) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002108) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002108) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002108) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00007824) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00007824) "ev2f79.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter NtDuplicateObject (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter ZwSetInformationFile (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter NtCreateSection (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter NtMapViewOfSection (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00008980) "ev2f79.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00008980) "ev2c34.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter NtQueryObject (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter NtDuplicateObject (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter ZwSetInformationFile (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter NtCreateSection (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter NtMapViewOfSection (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005176) "ev2c34.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00005176)40:T5ec,"SELECT Name FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Source: 36445-257-00C246A3, Indicator: "select name from win32_service where processid = %d and state="running"") "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Source: 36445-305-00C22E87, Indicator: "select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process") "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Proces" (Source: 00000000-00007812-00002714-711661616, Indicator: "select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_proces") "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Source: 00000000-00007812.00000000.151581.00B40000.00000004.mdmp, 00000000-00007812.00000000.151581.00C21000.00000020.mdmp, 00000000-00007812.00000000.151581.02E30000.00000004.mdmp, Indicator: "select __path, processid, csname, caption, sessionid, threadcount, workingsetsize, kernelmodetime, usermodetime from win32_process") "SELECT Name FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Source: 00000000-00007812.00000000.151581.00C21000.00000020.mdmp, Indicator: "select name from win32_service where processid = %d and state="running"")41:T54b,Sleep@KERNEL32.DLL at 00000000-00007812-36445-145-00C2ECC0 SleepConditionVariableSRW at 00000000-00007824-58821-98-0045B897 Sleep@KERNEL32.DLL at 00000000-00007824-58821-158-0045B7A0 WaitForMultipleObjects@KERNEL32.DLL at 00000000-00008980-59893-116-004FCA10 Sleep@KERNEL32.DLL at 00000000-00008980-59893-251-004F5590 SetTimer at 00000000-00008980-59893-711-00512010 SetTimer at 00000000-00008980-59893-812-0050FA80 SetTimer at 00000000-00008980-59893-1512-004DF630 SetTimer at 00000000-00008980-59893-1528-004DF2C0 SetTimer at 00000000-00008980-59893-1561-004DDF50 SetTimer at 00000000-00008980-59893-1567-004DDCA0 SetTimer at 00000000-00008980-59893-1586-004DC1F0 SetTimer at 00000000-00008980-59893-1619-004DA560 SetTimer at 00000000-00008980-59893-1634-004DA3B0 SetTimer at 00000000-00008980-59893-1636-004DA350 SetTimer at 00000000-00008980-59893-1917-004C4D80 SetTimer at 00000000-00008980-59893-1985-004BE760 SetTimer at 00000000-00008980-59893-2017-004BEB10 SetTimer at 00000000-00008980-59893-2518-0051A540 SetTimer at 00000000-00008980-59893-2519-0051AD40 Sleep@KERNEL32.DLL at 00000000-00008980-59893-2523-00525710 Sleep@KERNEL32.DLL at 00000000-00005176-64435-318-0040F960 SetTimer at 00000000-00005176-64435-320-0040F6E0 SetTimer at 00000000-00005176-64435-349-00405D60 SetTimer at 00000000-00005176-64435-355-0040C62042:T88f,Process _.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4288:168:WilStaging_02" Process _.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4288:168:WilStaging_02" Process _.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4288:64:WilError_03" Process _.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4288:64:WilError_03" Process _.exe created mutex with name "SM0:4288:168:WilStaging_02" Process _.exe created mutex with name "SM0:4288:64:WilError_03" Process _.exe created mutex with name "Local\SM0:4288:64:WilError_03" Process _.exe created mutex with name "Local\SM0:4288:168:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8704:168:WilStaging_02" Process cmd.exe created mutex with name "SM0:8704:168:WilStaging_02" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7812:168:WilStaging_02" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7812:168:WilStaging_02" Process tasklist.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7812:64:WilError_03" Process tasklist.exe created mutex with name "Local\SM0:7812:168:WilStaging_02" Process tasklist.exe created mutex with name "SM0:7812:168:WilStaging_02" Process tasklist.exe created mutex with name "SM0:7812:64:WilError_03" Process findstr.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8336:168:WilStaging_02" Process findstr.exe created mutex with name "SM0:8336:168:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3420:168:WilStaging_02" Process cmd.exe created mutex with name "SM0:3420:168:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2108:168:WilStaging_02" Process cmd.exe created mutex with name "SM0:2108:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7824:168:WilStaging_02" Process powershell.exe created mutex with name "SM0:7824:64:WilError_03" Process powershell.exe created mutex with name "Local\SM0:7824:168:WilStaging_02"43:T12d4,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "ev2c34.exe" failed to load missing module "zlib1.dll" - [base:0; Status:c0000135]44:T83b,Found string "CONNECT %s:%d HTTP/1.1Proxy-Authorization: Basic %sAccept: */*Host: %s:%dUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)Proxy-Connection: Keep-Alive" (Indicator: "mozilla/4.0 ("; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "CONNECT %s:%d HTTP/1.1Proxy-Authorization: Basic %sAccept: */*Host: %s:%dUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)Proxy-Connection: Keep-Alive" (Indicator: "user-agent: "; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "CONNECT %s:%d HTTP/1.1Accept: */*Host: %s:%dUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)Proxy-Connection: Keep-Alive" (Indicator: "mozilla/4.0 ("; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "CONNECT %s:%d HTTP/1.1Accept: */*Host: %s:%dUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)Proxy-Connection: Keep-Alive" (Indicator: "user-agent: "; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)" (Indicator: "mozilla/4.0 ("; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)" (Indicator: "user-agent: "; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)" (Indicator: "user-agent: "; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)Proxy-Connection: Keep-Alive" (Indicator: "mozilla/4.0 ("; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found string "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)Proxy-Connection: Keep-Alive" (Indicator: "user-agent: "; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp")45:T12f8,"Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004288.00000000.151415.00408000.00000002.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004288.00000000.151415.009C0000.00000004.mdmp "System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00005176.00000000.152411.004D2000.00000002.mdmp "SOFTWARE\Tencent\QQPinyin" in Source: 00000000-00005176.00000000.152411.004D2000.00000002.mdmp "SOFTWARE\Tencent\QQPinyin\J2FSwitchCount" in Source: 00000000-00005176.00000000.152411.004D2000.00000002.mdmp "SOFTWARE\Tencent\QQPinyin\WsCity" in Source: 00000000-00005176.00000000.152411.004D2000.00000002.mdmp "Software\Tencent\QQWubi" in Source: 00000000-00005176.00000000.152411.004D2000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00007824.00000000.152000.03140000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00007824.00000000.152000.03140000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007824.00000001.153519.00451000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007824.00000001.153519.00451000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007824.00000001.153519.00451000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007824.00000001.153519.00451000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007824.00000001.153519.00451000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007824.00000001.153519.00451000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007824.00000001.153519.031B6000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007824.00000001.153519.03400000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00007824.00000001.153519.03400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007824.00000001.153519.07902000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007824.00000001.153519.08519000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007824.00000001.153519.085E1000.00000004.mdmp "Software\SogouWBInput" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "Software\SogouInput.user" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SOFTWARE\SogouSearch" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "Software\SogouWBInput\Reboot" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SoftWare\Microsoft\CTF\TIP\%s\LanguageProfile\0x%08x\%s" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SOFTWARE\SogouInput" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Keyboard Layouts" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SoftWare\Microsoft\CTF\TIP" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SoftWare\Microsoft\CTF\SortOrder" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SoftWare\Microsoft\CTF\SortOrder\AssemblyItem" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SoftWare\Microsoft\CTF\SortOrder\Language" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SoftWare\Microsoft\CTF\Assemblies" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "Software\SogouInput" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp "SoftWare\SogouImeSkinEditor" in Source: 00000000-00008980.00000001.152233.0052F000.00000002.mdmp46:T281d,"_.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75140000 "_.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 750c0000 "_.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 75090000 "_.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 75bd0000 "_.exe" loaded module "NTDLL.DLL" at base 77500000 "_.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "_.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74f20000 "_.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 74ef0000 "_.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74ee0000 "_.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 74e80000 "_.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76950000 "_.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74e70000 "_.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 74e60000 "_.exe" loaded module "KERNEL32.DLL" at base 76040000 "_.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 747d0000 "_.exe" loaded module "%TEMP%\NSUD41.TMP\NSEXEC.DLL" at base 10000000 "_.exe" loaded module "%TEMP%\NSUD41.TMP\SYSTEM.DLL" at base 10000000 "_.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76fb0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75140000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76040000 "cmd.exe" loaded module "NTDLL.DLL" at base 77500000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75140000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 76440000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76710000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 743c0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 74300000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 742f0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 74220000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76710000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76710000 "tasklist.exe" loaded module "AMSI.DLL" at base 74200000 "tasklist.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "tasklist.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "tasklist.exe" loaded module "KERNEL32" at base 76040000 "tasklist.exe" loaded module "%WINDIR%\SYSWOW64\4JG8JJ58.DLL" at base 741c0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 741a0000 "tasklist.exe" loaded module "NTDLL.DLL" at base 77500000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75140000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 761f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76710000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76710000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74540000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76d90000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74e50000 "powershell.exe" loaded module "VERSION.DLL" at base 74e70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 73cf0000 "powershell.exe" loaded module "USER32.DLL" at base 762a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76710000 "powershell.exe" loaded module "MSCOREE.DLL" at base 745d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76a70000 "powershell.exe" loaded module "PSAPI.DLL" at base 76130000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76440000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\EF4992F14BA62DC115C01E7A6018E263\MSCORLIB.NI.DLL" at base 727c0000 "powershell.exe" loaded module "OLE32.DLL" at base 76ec0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76a70000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76cf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72780000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76fb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76710000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\67186481D97828A572BF5DB055F4A9F1\SYSTEM.NI.DLL" at base 71c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\C20AFD70AEB352395F8F5297A727F0BA\SYSTEM.CORE.NI.DLL" at base 71470000 "powershell.exe" loaded module "COMBASE.DLL" at base 76a70000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76a70000 "powershell.exe" loaded module "NTDLL.DLL" at base 77500000 "powershell.exe" loaded module "SHELL32.DLL" at base 755d0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 76a10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 77010000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\416015A614FB5F5C53CD9CCBF0E5E13F\SYSTEM.XML.NI.DLL" at base 705d0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 77010000 "powershell.exe" loaded module "WLDP.DLL" at base 74800000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 75360000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 75340000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 752f0000 "powershell.exe" loaded module "AMSI.DLL" at base 75120000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 752e0000 "powershell.exe" loaded module "KERNEL32" at base 76040000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\4JG8JJ58.DLL" at base 75090000 "powershell.exe" loaded module "NTDLL" at base 77500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\0FC458E2E89A1743B9BB2C58049A8F4F\SYSTEM.CONFIGURATION.NI.DLL" at base 71360000 "powershell.exe" loaded module "BCRYPT.DLL" at base 75bb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 70250000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 76a70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 75040000 "powershell.exe" loaded module "SECUR32.DLL" at base 75030000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75000000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74f80000 "powershell.exe" loaded module "URLMON.DLL" at base 71060000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76710000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 74f40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 70d70000 "powershell.exe" loaded module "OLEAUT32" at base 76cf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 76710000 "powershell.exe" loaded module "MSVCRT.DLL" at base 77430000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 74f30000 "powershell.exe" loaded module "MI.DLL" at base 74f10000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 76710000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 74680000 "powershell.exe" loaded module "GDI32.DLL" at base 76010000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 74ef0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 74e60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6fcb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76710000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76710000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 76040000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 76710000 "ev2f79.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75140000 "ev2f79.exe" loaded module "KERNEL32.DLL" at base 76040000 "ev2f79.exe" loaded module "ADVAPI32.DLL" at base 761f0000 "ev2f79.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 76710000 "ev2f79.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "ev2f79.exe" loaded module "KERNEL32" at base 76040000 "ev2f79.exe" loaded module "RPCRT4.DLL" at base 76440000 "ev2f79.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74e50000 "ev2c34.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75140000 "ev2c34.exe" loaded module "KERNEL32.DLL" at base 76040000 "ev2c34.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74f60000 "ev2c34.exe" loaded module "RPCRT4.DLL" at base 76440000 "ev2c34.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76040000 "ev2c34.exe" loaded module "SHELL32.DLL" at base 755d0000 "ev2c34.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 76710000 "ev2c34.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76710000 "ev2c34.exe" loaded module "KERNEL32" at base 76040000 "ev2c34.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74e5000047:T414,".exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" ".exe" was detected as "Microsoft Linker" and name: "Linker" "ev2f79.exe.nhpart_48f89964d4ab" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ev2f79.exe.nhpart_48f89964d4ab" was detected as "Microsoft Linker" and name: "Linker" "Snipaste Installer.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Snipaste Installer.exe" was detected as "Microsoft Linker" and name: "Linker" "ev2c34.exe.nhpart_8200df9dbca5" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "ev2c34.exe.nhpart_8200df9dbca5" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker" "nsExec.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsExec.dll" was detected as "Microsoft Linker" and name: "Linker"48:T716,"_.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "_.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "_.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "tasklist.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")49:T4cb,"_.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "_.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "_.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")4a:Td3f,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00004288-00000C2B-708581359] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00004288-00000C2B-708609526] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00004288-00000C2B-708655830] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00004288-00000C2B-708811031] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00004288-00000C2B-708855568] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00004288-00000C2B-708884333] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00004288-00000C2B-708908298] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00004288-00000C2B-708939267] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00004288-00000C2B-708965680] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00004288-00000C2B-708991756] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00004288-00000C2B-709019265] Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00007812-00000C2B-711034059] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007824-00000C2B-718126362] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007824-00000C2B-718847910] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007824-00000C2B-718947543] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007824-00000C2B-719002410] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll" [Source: 00000000-00007824-00000C2B-719550808] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007824-00000C2B-719604126] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007824-00000C2B-719669045] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007824-00000C2B-719769456] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007824-00000C2B-719981221] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007824-00000C2B-720002322] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll" [Source: 00000000-00007824-00000C2B-720271905] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll" [Source: 00000000-00007824-00000C2B-720326376] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007824-00000C2B-720460250]4b:T13b8,"ev2f79.exe.nhpart_48f89964d4ab" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections"- Location: [%APPDATA%\comain_ev2f79\ev2f79.exe.nhpart_48f89964d4ab]- [targetUID: 00000000-00004288] "Snipaste Installer.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%PROGRAMFILES%\(x86)\Community\Snipaste Installer.exe]- [targetUID: 00000000-00004288] "ev2c34.exe.nhpart_8200df9dbca5" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%APPDATA%\comain_ev2c34\ev2c34.exe.nhpart_8200df9dbca5]- [targetUID: 00000000-00004288] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsuD41.tmp\System.dll]- [targetUID: 00000000-00007824] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsuD41.tmp\nsExec.dll]- [targetUID: 00000000-00004288] "nszC94.tmp" has type "data"- Location: [%TEMP%\nszC94.tmp]- [targetUID: 00000000-00004288] "nh_3209290f3a4e.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_3209290f3a4e.nhc]- [targetUID: 00000000-00004288] "dxyvnb.ti.nhpart_3209290f3a4e" has type "data"- Location: [%APPDATA%\comain_ev2f79\dxyvnb.ti.nhpart_3209290f3a4e]- [targetUID: 00000000-00004288] "nh_48f89964d4ab.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_48f89964d4ab.nhc]- [targetUID: 00000000-00004288] "nh_8200df9dbca5.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_8200df9dbca5.nhc]- [targetUID: 00000000-00004288] "nh_fb26a3da266f.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_fb26a3da266f.nhc]- [targetUID: 00000000-00004288] "yinma.vc.nhpart_fb26a3da266f" has type "data"- Location: [%APPDATA%\comain_ev2f79\yinma.vc.nhpart_fb26a3da266f]- [targetUID: 00000000-00004288] "nh_1cdda6b5f709.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_1cdda6b5f709.nhc]- [targetUID: 00000000-00004288] "bteuns.pt.nhpart_1cdda6b5f709" has type "data"- Location: [%APPDATA%\comain_ev2c34\bteuns.pt.nhpart_1cdda6b5f709]- [targetUID: 00000000-00004288] "nh_aba42f2cdfff.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_aba42f2cdfff.nhc]- [targetUID: 00000000-00004288] "bnymir.ou.nhpart_aba42f2cdfff" has type "data"- Location: [%APPDATA%\comain_ev2c34\bnymir.ou.nhpart_aba42f2cdfff]- [targetUID: 00000000-00004288] "nh_5629f3e0a1ed.nhc" has type "data"- [targetUID: 00000000-00004288] "ntrin.er.nhpart_5629f3e0a1ed" has type "data"- Location: [%APPDATA%\comain_ev2f79\ntrin.er.nhpart_5629f3e0a1ed]- [targetUID: 00000000-00004288] "nh_995a8954d15f.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_995a8954d15f.nhc]- [targetUID: 00000000-00004288] "cmrsk.ce.nhpart_995a8954d15f" has type "data"- Location: [%APPDATA%\comain_ev2c34\cmrsk.ce.nhpart_995a8954d15f]- [targetUID: 00000000-00004288] "nh_71a9a329e4b4.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_71a9a329e4b4.nhc]- [targetUID: 00000000-00004288] "otrm.oi.nhpart_71a9a329e4b4" has type "data"- Location: [%APPDATA%\comain_ev2f79\otrm.oi.nhpart_71a9a329e4b4]- [targetUID: 00000000-00004288] "nh_9c9d6820913a.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_9c9d6820913a.nhc]- [targetUID: 00000000-00004288] "fhkan.oi.nhpart_9c9d6820913a" has type "data"- Location: [%APPDATA%\comain_ev2c34\fhkan.oi.nhpart_9c9d6820913a]- [targetUID: 00000000-00004288] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007824] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00007824] "local.stat" has type "data"- Location: [%APPDATA%\Tencent\QQPinyin\local.stat]- [targetUID: 00000000-00005176] "nh_db6dd1863c61.nhc" has type "data"- Location: [%TEMP%\nsuD41.tmp\nh_db6dd1863c61.nhc]- [targetUID: 00000000-00004288] "ap.asin.nhpart_db6dd1863c61" has type "data"- Location: [%APPDATA%\comain_ev2c34\ap.asin.nhpart_db6dd1863c61]- [targetUID: 00000000-00004288] "__PSScriptPolicyTest_svuvjmkl.2ei.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_svuvjmkl.2ei.psm1]- [targetUID: 00000000-00007824] "windowsz.txt" has type "very short file (no magic)"- Location: [%TEMP%\windowsz.txt]- [targetUID: 00000000-00008980] "uk_tmp.txt" has type "very short file (no magic)"- Location: [%TEMP%\uk_tmp.txt]- [targetUID: 00000000-00005176] "__PSScriptPolicyTest_30hlyxys.wz3.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_30hlyxys.wz3.ps1]- [targetUID: 00000000-00007824] "__PSScriptPolicyTest_dadhufbk.vrl.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_dadhufbk.vrl.ps1]- [targetUID: 00000000-00007824] "__PSScriptPolicyTest_2wu5zgvw.bxs.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_2wu5zgvw.bxs.psm1]- [targetUID: 00000000-00007824]4c:T51e,"_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}\"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")4d:Tbbb,"_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "DATA"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "GENERATION"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "_.EXE"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000603XX"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "F25BCD2E-2690-55DC-3BC4-07B65B1B41C9"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEUMPDBUFFERSIZECHECK"; Value: "")4e:T471,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API)4f:T45b,"_.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "_.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "_.exe" trying to access non-existent file "C:\MSVCP140.dll" "_.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "_.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll" "_.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "_.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp\nsExec.dll" "_.exe" trying to access non-existent file "C:\cmd.exe" "_.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp\System.dll" "cmd.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "cmd.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "tasklist.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll"50:T42e,"2.5.29.37" "2.5.29.35" "192.168.0.2" "92.168.0.2" Potential IP "4.0.0.0" found in string "System,4.0.0.0,,b77a5c561934e089" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "4.0.0.00000009" "4.0.0.02" "4.0.0.0" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" "2.5.29.15" "2.5.29.19" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" "2.5.29.14" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string ".Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "ft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35" "2.5.29.16" "2.5.29.1" "2.5.4.3" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "2.5.29.32" "2.5.29.10" "2.5.4.10" "2.5.4.8" "2.5.4.11" "2.5.4.5" "2.5.4.6" "2.5.4.7"51:T4d71,Found URL "http://pyhelp.qq.com/cgi-bin/pyidconf.so?id=%d&gd=%s%.2xhandinput_tmp.datqqdownload\.tdl.xftptencent_qqpinyin_hand_input_jkrzlib1.dllhandinputposxhandinputposysocksmailtonewsfilehttpshttpgopher%04d%04d%02darialgb23124.3.1091.400recordpothandinput.potkernel32.dllcheckregstatuscommonsetshuangpinqqpyrapeenlishsymbolcandnumlimituserwordmaxuserwordnumfuzzysetkeysetchangelanguagetwothreecandshuangpinfilecolorhuecolorsatcolorlightautochecksetenablecelldictenablecelldictupdateenablecloudenablecloudaddonposadvancesetabcstrokemodstatusbarkeysoftboardkeybig5keyquanshuangengkeyconfigkeycamerakeymakewordkeynetsetupdateime2updatedictspaceconvertletterselectinputstylecandwndverticalcandhrelateuisetwordimageimaginationlocationimaginationlengthimaginationnumberenablephrasenotsinglenumberuserworddeleteshortcutseperatorglobalstateenablepreferredwordsyncintervalnumpadselectnumkeyselectlookup2enablehotkeymodifiervirtualkeycontextimaginefixorderfixorderfilenameautosynchautosynccfgsetfuzzytipsnoticetipswndenglishmixmodeenglishcapsmodeenglishvmodeenglishautospacemodeenablepicfaceenableallpicfaceincmpwndenablecharfaceenbaleallcharfaceincmpwndpicfaceenableallprocsupporturlguidesupportsplitwordsupportnamestyleshowjianfantiptimesenablenewwordupdatetipssupportfixtoptipsenableclipmonitorenableclipmontipssaveclipmonxcontentclipmononlycollectcharenablesupperjianpinfull2halftocommentautocouplepunctshowcopunctballoontimesclosemakewordtoolstarindexstartextbloghotkeybloglocktimeblogautoclosehandinputhotkeyhandinputalphahandinputnumberhandinputautotoscrhandinputautoupdatehandinputexpandpunctstrokerexpandpunctenduserdefinedcharaterseudctiptimesenableistateupdownconfigmodulessyncdictmodulescleardictmodulesinitsimplecharsetenablej2ftipsj2ftipspopupcountshuangusejianpinshuangfzm4singlewordshuangfzmwordsfirstenablewsenabletransenablertxnameenableupdatertxnameswithuserstylebc.databc.datpyjj.dat003.datziranma.datunispim.datstatusposxstatusposycomppositionxyimesynctimefixorderfileabcorderfixorder_abc.datdefaultorderopenstatustransparentvaluesoftware\tencent\qqpinyin\j2fswitchcountnamesoftware\tencent\qqpinyin\wscitycreateluiaxlasterrortypecreateluiaxlasterrorvaluelastrepairpopuperrorcodelastcoredictloadfailederrorcodemodule%d.%d.%d.%d,%04d-%02d-%02d" - Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found URL "http://pragma:" - Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007824.00000001.153519.03140000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ev'=la'9iqmgvw,czcsb'=xb'=xw'mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://cwashington1redmond1microsoft" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0dyd!0[p%0" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0qhwbs-ztxnw,xzz" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0ahq.a)d$g5" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0:'l$zmsnc" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/prts/microsoft%20time-stamp%20pca%202010(1).crt0::vm4" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.micro$%'%f'<]b" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bba\hwc07p(3jit)lsq(" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0jj" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbtw*hion1ous1p,r],-stamptcerts/t%202err<$]-4xrcm^ub3tp:/mrts/m%202ahq.a)d$g5" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1)kiopa" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.com8'<" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.microsoft.comhttp://www.m,hiqpq<" - Source: "00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found URL "http://www.sogou.com/feedback/?product=%cb%d1%b9%b7%ce%e5%b1%ca%ca%e4%c8%eb%b7%a8&addon=%0aoperation" - Source: "00000000-00008980.00000001.152233.0052F000.00000002.mdmp") Found URL "http://wubi.sogou.com/help/wizard.exezuanzongzhuozhunzhuizhuangzhuanzhuaizhuazhouzhongzhengzhenzheizhaozhangzhanzhaizengzangyuanyongyingyangxuanxiongxingxiaoxiangxianwengwangtuantongtingtiaotiantengtangsuansongshuoshunshuishuangshuanshuaishuashoushengshensheishaoshangshanshaisengsangruanrongrengrangquanqiongqingqiaoqiangqianpingpiaopianpengpangnuannongningniaoniangniannengnangmingmiaomianmengmangluanlonglingliaolianglianlenglangkuangkuankuaikongkengkangjuanjiongjingjiaojiangjianhuanghuanhuaihonghenghangguangguanguaigonggenggangfiaofengfangduandongdingdiaodiandengdangcuancongchuochunchuichuangchuanchuaichuachouchongchengchenchaochangchanchaicengcangbingbiaobianbengbanggetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchcustomphrasedict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsavesearchupdatedumpmergepyadjdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchpyrevertdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchgetcompiletimepysysdict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsearchupdatesavemergeverifyexporttxtimporttxtpyusrdict.dllsetsavestubsaveallgetplugintypeisfullrelayoutmemloadsavesearchupdatedumpmergesogouwbdeldict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchsymboldict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsavesearchupdatedumpmergewbadjdict.dllgetplugintypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsavesearchupdatewbquerypydict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchmatchbystringmatchbytypematchbycandgetbydataindexwbquickdict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsearchupdatesavewbquickusrdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchwbrevertdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchgetcompiletimewbsysdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullupdatesearchwbtempusrdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadtranslatewbtradict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsaveupdatesearchgetallwordsmergeverifyexporttxtwbusrdict.dllpluginspluginswbusrdict.dllpluginswbadjdict.dlllocal\wbdeldict*.txt)*.txt*.bin)*.bin.txt.binbin/txt)ilemaph" - Source: "00000000-00008980.00000001.152233.0052F000.00000002.mdmp") Found URL "http://wubi.sogou.comshift" - Source: "00000000-00008980.00000001.152233.0052F000.00000002.mdmp") Found URL "http://wubi.sogou.com/skins/zuanzongzhuozhunzhuizhuangzhuanzhuaizhuazhouzhongzhengzhenzheizhaozhangzhanzhaizengzangyuanyongyingyangxuanxiongxingxiaoxiangxianwengwangtuantongtingtiaotiantengtangsuansongshuoshunshuishuangshuanshuaishuashoushengshensheishaoshangshanshaisengsangruanrongrengrangquanqiongqingqiaoqiangqianpingpiaopianpengpangnuannongningniaoniangniannengnangmingmiaomianmengmangluanlonglingliaolianglianlenglangkuangkuankuaikongkengkangjuanjiongjingjiaojiangjianhuanghuanhuaihonghenghangguangguanguaigonggenggangfiaofengfangduandongdingdiaodiandengdangcuancongchuochunchuichuangchuanchuaichuachouchongchengchenchaochangchanchaicengcangbingbiaobianbengbanggetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchcustomphrasedict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsavesearchupdatedumpmergepyadjdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchpyrevertdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchgetcompiletimepysysdict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsearchupdatesavemergeverifyexporttxtimporttxtpyusrdict.dllsetsavestubsaveallgetplugintypeisfullrelayoutmemloadsavesearchupdatedumpmergesogouwbdeldict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchsymboldict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsavesearchupdatedumpmergewbadjdict.dllgetplugintypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsavesearchupdatewbquerypydict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchmatchbystringmatchbytypematchbycandgetbydataindexwbquickdict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsearchupdatesavewbquickusrdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchwbrevertdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadsearchgetcompiletimewbsysdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullupdatesearchwbtempusrdict.dllgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskloadtranslatewbtradict.dllsetsavestubsaveallgetplugintypegetdlldicttypeprioritygetnamegetfilenamepathmaskisfullrelayoutmemloadsaveupdatesearchgetallwordsmergeverifyexporttxtwbusrdict.dll*.bin)*.bin*.bin)*.bin*.bin)*.bin*.txt)*.txthttp://wubi.sogou.com/dict/cel:local\wbextdictlocal\pyextdictscdlist.iniscdlist.ini.bakwubiup.exe-reportspeedmeter.exelocal\wbabbrmapwubiup.exectrl" - Source: "00000000-00008980.00000001.152233.0052F000.00000002.mdmp")52:T42b,Found string "CONNECT %s:%d HTTP/1.1Proxy-Authorization: Basic %sAccept: */*Host: %s:%dUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)Proxy-Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "CONNECT %s:%d HTTP/1.1Accept: */*Host: %s:%dUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)Proxy-Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/CONNECT %s:%d HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found string "CONNECT %s:%d HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp")53:T68a,Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00005176.00000000.152411.0041F000.00000080.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00007812.00000000.151581.00C32000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007812.00000000.151581.00C32000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007812.00000000.151581.00C32000.00000002.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00007812.00000000.151581.00C32000.00000002.mdmp")54:Te04,Found string "bcrypt::BCryptOpenAlgorithmProvider(*p .R0, w "AES", p 0, i 0) i .R6" (Indicator: "aes"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004288.00000000.151415.03080000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004288.00000000.151415.03080000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004288.00000000.151415.03080000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004288.00000000.151415.03080000.00000002.mdmp") Found string "{Aes" (Indicator: "aes"; Source: "00000000-00004288.00000001.152147.02560000.00000040.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004288.00000001.152147.02B90000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004288.00000001.152147.02B90000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004288.00000001.152147.02B90000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004288.00000001.152147.02B90000.00000002.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007824.00000001.153519.00451000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007824.00000001.153519.031B6000.00000004.mdmp, 00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007824.00000001.153519.031B6000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007824.00000001.153519.031B6000.00000004.mdmp, 00000000-00007824.00000001.153519.07902000.00000004.mdmp") Found string "AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007824.00000001.153519.07902000.00000004.mdmp")55:T5b0,Observed string: "cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (Indicator: " tasklist ") in Source: 00000000-00004288-00000C46-3274954192 Observed string: "%WINDIR%\SysWOW64\tasklist.exe" [Source: 00000000-00008704-00000BC0-710261383] Observed string: "%WINDIR%\system32\tasklist.exe" [Source: 00000000-00008704-00000C47-877569418] Observed string: "tasklist.exe" [Source: 00000000-00007812-00000BC0-710315552] Observed string: "/C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (Indicator: " tasklist ") in Source: cmd.exe Observed string: "exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (Indicator: " tasklist ") in Source: 00000000-00004288.00000000.151415.009C0000.00000004.mdmp Observed string: "cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"" (Indicator: " tasklist ") in Source: 00000000-00004288.00000000.151415.009C0000.00000004.mdmp Observed string: "tasklist.exe" [Source: 00000000-00007812.00000000.151581.00B40000.00000004.mdmp 00000000-00007812.00000000.151581.00C32000.00000002.mdmp 00000000-00007812.00000000.151581.02E22000.00000004.mdmp 00000000-00007812.00000000.151581.02E30000.00000004.mdmp] Observed string: "C:\WINDOWS\SysWOW64\tasklist.exe" [Source: 00000000-00007812.00000000.151581.02DF0000.00000004.mdmp] Observed string: "Device\HarddiskVolume2\Windows\SysWOW64\tasklist.exe" [Source: 00000000-00007812.00000000.151581.02DF0000.00000004.mdmp]56:T6f8,Found string "SELECT Name FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Indicator: " Win32_Service"; File: "00000000-00007812.00000000.151581.00C21000.00000020.mdmp") Found string "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; File: "00000000-00007812.00000000.151581.00C21000.00000020.mdmp") Found string "ame FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Indicator: " Win32_Service"; File: "00000000-00007812.00000000.151581.00C21000.00000020.mdmp") Found string "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp, 00000000-00007812.00000000.151581.00C21000.00000020.mdmp, 00000000-00007812.00000000.151581.02E30000.00000004.mdmp") Found string "SELECT Name FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Indicator: " Win32_Service"; Source: "00000000-00007812.00000000.151581.00C21000.00000020.mdmp") Found string "ECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00007812.00000000.151581.02E22000.00000004.mdmp") Found string "ExecQuery(SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process);" (Indicator: " Win32_Process"; Source: "00000000-00007812.00000000.151581.02E22000.00000004.mdmp") Found string "from win32_process" (Indicator: " Win32_Process"; Source: "00000000-00007812.00000000.151581.02E30000.00000004.mdmp")57:T130e,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000000.151415.02650000.00000004.mdmp, 00000000-00004288.00000000.151415.027C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.02650000.00000004.mdmp, 00000000-00004288.00000001.152147.027C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000000.151415.02650000.00000004.mdmp, 00000000-00004288.00000000.151415.027C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.02650000.00000004.mdmp, 00000000-00004288.00000001.152147.027C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\??\Volume{815ead30-0000-0000-0000-50d00e000000}" (Indicator: "\Device\"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005176.00000000.152411.006A0000.00000004.mdmp, 00000000-00005176.00000000.152411.00B10000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005176.00000000.152411.006A0000.00000004.mdmp, 00000000-00005176.00000000.152411.00B10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\comain_ev2c34\ev2c34.exe" (Indicator: "\Device\"; Source: "00000000-00005176.00000000.152411.006A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00005176.00000000.152411.006A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp, 00000000-00007812.00000000.151581.02DF0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp, 00000000-00007812.00000000.151581.02DF0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\Dri!" (Indicator: "\drivers\"; Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\Dri!" (Indicator: "system32\drivers"; Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007824.00000000.152000.030E0000.00000004.mdmp, 00000000-00007824.00000000.152000.03140000.00000004.mdmp, 00000000-00007824.00000000.152000.03410000.00000004.mdmp, 00000000-00007824.00000001.153519.03140000.00000004.mdmp, 00000000-00007824.00000001.153519.031B6000.00000004.mdmp, 00000000-00007824.00000001.153519.03410000.00000004.mdmp, 00000000-00007824.00000001.153519.07902000.00000004.mdmp, 00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007824.00000000.152000.030E0000.00000004.mdmp, 00000000-00007824.00000000.152000.03140000.00000004.mdmp, 00000000-00007824.00000000.152000.03410000.00000004.mdmp, 00000000-00007824.00000001.153519.03140000.00000004.mdmp, 00000000-00007824.00000001.153519.031B6000.00000004.mdmp, 00000000-00007824.00000001.153519.03410000.00000004.mdmp, 00000000-00007824.00000001.153519.07902000.00000004.mdmp, 00000000-00007824.00000001.153519.085E1000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\Dri" (Indicator: "\drivers\"; Source: "00000000-00007824.00000000.152000.03410000.00000004.mdmp, 00000000-00007824.00000001.153519.03410000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\Dri" (Indicator: "system32\drivers"; Source: "00000000-00007824.00000000.152000.03410000.00000004.mdmp, 00000000-00007824.00000001.153519.03410000.00000004.mdmp")58:T47b,file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; File: "nsExec.dll") file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; File: "nsExec.dll") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00004288.00000000.151415.10002000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004288.00000000.151415.10002000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00005176.00000000.152411.004D2000.00000002.mdmp")59:Tae6,"_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\COMAIN_EV2F79\EV2F79.EXE"; Value: "") "_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\COMAIN_EV2C34\EV2C34.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\TASKLIST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\FINDSTR.EXE"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "")5a:T803,Dropped file: "ev2f79.exe.nhpart_48f89964d4ab" - Location: [%APPDATA%\comain_ev2f79\ev2f79.exe.nhpart_48f89964d4ab]- [targetUID: 00000000-00004288] Dropped file: "ev2c34.exe.nhpart_8200df9dbca5" - Location: [%APPDATA%\comain_ev2c34\ev2c34.exe.nhpart_8200df9dbca5]- [targetUID: 00000000-00004288] Dropped file: "dxyvnb.ti.nhpart_3209290f3a4e" - Location: [%APPDATA%\comain_ev2f79\dxyvnb.ti.nhpart_3209290f3a4e]- [targetUID: 00000000-00004288] Dropped file: "yinma.vc.nhpart_fb26a3da266f" - Location: [%APPDATA%\comain_ev2f79\yinma.vc.nhpart_fb26a3da266f]- [targetUID: 00000000-00004288] Dropped file: "bteuns.pt.nhpart_1cdda6b5f709" - Location: [%APPDATA%\comain_ev2c34\bteuns.pt.nhpart_1cdda6b5f709]- [targetUID: 00000000-00004288] Dropped file: "bnymir.ou.nhpart_aba42f2cdfff" - Location: [%APPDATA%\comain_ev2c34\bnymir.ou.nhpart_aba42f2cdfff]- [targetUID: 00000000-00004288] Dropped file: "ntrin.er.nhpart_5629f3e0a1ed" - Location: [%APPDATA%\comain_ev2f79\ntrin.er.nhpart_5629f3e0a1ed]- [targetUID: 00000000-00004288] Dropped file: "cmrsk.ce.nhpart_995a8954d15f" - Location: [%APPDATA%\comain_ev2c34\cmrsk.ce.nhpart_995a8954d15f]- [targetUID: 00000000-00004288] Dropped file: "otrm.oi.nhpart_71a9a329e4b4" - Location: [%APPDATA%\comain_ev2f79\otrm.oi.nhpart_71a9a329e4b4]- [targetUID: 00000000-00004288] Dropped file: "fhkan.oi.nhpart_9c9d6820913a" - Location: [%APPDATA%\comain_ev2c34\fhkan.oi.nhpart_9c9d6820913a]- [targetUID: 00000000-00004288] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007824] Dropped file: "ModuleAnalysisCache" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00007824] Dropped file: "local.stat" - Location: [%APPDATA%\Tencent\QQPinyin\local.stat]- [targetUID: 00000000-00005176] Dropped file: "ap.asin.nhpart_db6dd1863c61" - Location: [%APPDATA%\comain_ev2c34\ap.asin.nhpart_db6dd1863c61]- [targetUID: 00000000-00004288]5b:T843,Found string "MulDiv" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "DeleteFileA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringA" (Source: .exe, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringA" (Source: .exe, API is part of module: KERNEL32.DLL) Found string "MultiByteToWideChar" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "FreeLibrary" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "SearchPathA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "GetShortPathNameA" (Source: .exe, API is part of module: KERNEL32.DLL) Found string "GetFullPathNameA" (Source: .exe, API is part of module: KERNELBASE.DLL) Found string "MoveFileA" (Source: .exe, API is part of module: KERNEL32.DLL) Found string "SetCurrentDirectoryA" (Source: .exe, API is part of module: KERNELBASE.DLL)5c:T4d2,FindResourceExW@KERNEL32.DLL at 00000000-00007824-58821-100-0045F5DC FindResourceExW@KERNEL32.DLL at 00000000-00007824-58821-104-0045F441 FindResourceW@KERNEL32.DLL at 00000000-00008980-59893-782-004AF500 FindResourceW@KERNEL32.DLL at 00000000-00008980-59893-1764-004D0F40 FindResourceW@KERNEL32.DLL at 00000000-00008980-59893-1766-004D09E0 FindResourceW@KERNEL32.DLL at 00000000-00008980-59893-1842-004C83B0 FindResourceW@KERNEL32.DLL at 00000000-00008980-59893-2449-004D0230 FindResourceW@KERNEL32.DLL at 00000000-00008980-59893-3759-004AF4D0 FindResourceW@KERNEL32.DLL at 00000000-00005176-64435-173-00406720 LoadResource@KERNEL32.DLL at 00000000-00005176-64435-174-00402D40 FindResourceExW@KERNEL32.DLL at 00000000-00005176-64435-175-00402DA0 FindResourceW@KERNEL32.DLL at 00000000-00005176-64435-341-0040C423 FindResourceW@KERNEL32.DLL at 00000000-00005176-64435-342-0040C3A0 FindResourceW@KERNEL32.DLL at 00000000-00005176-64435-409-00406E70 FindResourceW@KERNEL32.DLL at 00000000-00005176-64435-450-00404640 FindResourceW@KERNEL32.DLL at 00000000-00005176-64435-484-00402496 FindResourceW@KERNEL32.DLL at 00000000-00005176-64435-493-00402410 SizeofResource@KERNEL32.DLL at 00000000-00005176-64435-2883-0043DD805d:T1047,Found string "root\cimv2" (Indicator: "root\cimv2"; in File: "00000000-00007812.00000000.151581.00C21000.00000020.mdmp") Found string "-FVVF82A\root\cimv2:Win" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="9036"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="9132"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="9044"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7676"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="1968"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="3584"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="3292"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="9104"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="8924"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4868"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="8820"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="8220"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7736"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="1696"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="5916"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="5180"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7708"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="8336"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="8984"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4288"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="8512"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="8180"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7088"" (Indicator: "root\cimv2"; in Source: "00000000-00007812.00000000.151581.00B40000.00000004.mdmp")5e:T827,"_.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nspC55.tmp" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ev2f79.exe.nhpart_48f89964d4ab" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp\nh_48f89964d4ab.nhc" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ntrin.er.nhpart_5629f3e0a1ed" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp\nh_5629f3e0a1ed.nhc" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\otrm.oi.nhpart_71a9a329e4b4" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp\nh_71a9a329e4b4.nhc" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\yinma.vc.nhpart_fb26a3da266f" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp\nh_fb26a3da266f.nhc" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\dxyvnb.ti.nhpart_3209290f3a4e" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp\nh_3209290f3a4e.nhc" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\ev2c34.exe.nhpart_8200df9dbca5" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuD41.tmp\nh_8200df9dbca5.nhc" with delete access "_.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\bnymir.ou.nhpart_aba42f2cdfff" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_30hlyxys.wz3.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_2wu5zgvw.bxs.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_dadhufbk.vrl.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_svuvjmkl.2ei.psm1" with delete access5f:T480,"_.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ev2f79.exe" (Handle: 804) "_.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2f79\ev2f79.exe" (Handle: 804) "_.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\ev2c34.exe" (Handle: 860) "_.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\comain_ev2c34\ev2c34.exe" (Handle: 860) "cmd.exe" wrote 000011C0 bytes to a remote process "C:\Windows\SysWOW64\tasklist.exe" (Handle: 512) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\tasklist.exe" (Handle: 512) "cmd.exe" wrote 000011C0 bytes to a remote process "C:\Windows\SysWOW64\findstr.exe" (Handle: 508) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\findstr.exe" (Handle: 508) "cmd.exe" wrote 000011C0 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 496) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 496)60:T984,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAG6UlEQVR4XsWTaVCVZRTHrUkvF0QWCbmXfbMvOfWxRnFXQM21olwCWeRiamQppZYrZIuaIZaaGYkKmJKiFi0Ow1Rumem4Tn0opy9lMyrgBui//znP+957Xdo/9M785nm53vv8zv+cY6dOf/I8+APw4BnAVXUO7u1tcNW1K26lQ/H9bX0m36v6Fb1Od6AXf3vrnf/ouZ+XPHD6Bpxv/AznqmYEVLTegRY4eXrh95yvnUXqwctI2df63wpIPXgJwq2f/53H/elvcDec+1e/9T7R/+GSkNqz6Fb941//tnPRF+hS9LnFZ97TkfcR9JKan/Td4fmUn/vBv+Uzh+cTBBBH4R4EFH6MgCm7EJBdg87rTuOeNafgzKlGYP5OOPPredbz3MGT8E4twCc3OKZaheTtQOfyY7in/Cgc/IGRkcIGCht4fmwJhT1wTtkNZ8EuBBZQxgLuWnYYd5OgnBrK6sh2BFEaxPeg3A/RNXfbrQVIss80WRcKApjIkbMVjuxaXlxvySji6eQZQJkINVmBJNupSQPzKZlci8AJlQiaSFhM0ORtZCuhWGBRXXm3VYBIG9ClUFLZyT4xMpXU+2GE0kYn0wTmSStJbp2VrE5lPolNLbqykGC+B2dvIdUIfmqTKUBkDm0jKditOOXUue3UdCbZDgRZs1OhwrbmSjqTUFIpIvDKyFPCZnSjVJlUhW4TN1oF+CUzS2JkTp0bEYmm2865EU24zUpVrckUkWiyLegm0kkUTtrEc6Ml/EAJmfA+qVS0AG2ldzN9skBpo6TLkbnVWulMK6M9H6Lp1C+Qp/7QWcR6apjMJAyhVNIJISJURPg+QoXxGxD65HqEES3g5lbaS2LLTMJgwdvGzfC83aTyGzcMJRu+MhLKQnmGSkIRKe+p0EjfRegTaxH2xBqEZa0xBXjnJssiLVShaaW2U6SSStoo8PKymgMU38D169f1LKveh5An11EmIiOUhGEqW0fZWiWc4vCsdxD+uPC2KeA2mb9Q2yjt9JsdLy7b8rXKhY6ODpRt/lITqUyF76gsjBJb1l1Zje6PVRgefcsUYLZSoEwWZoIlk5ZKC+25Keu1hWWbv1Jxe3u7UrapCWG8NIwCkYU/XmHJVlnCVSrsPm4lInhGyEm0AP8lCZF52XOzZmdaaSXTVBUqbGtr8xZQurGRgnJLJmc5RTzHvcnTyO7l+71jl5MViJRzzDJTgE/2rpHpaYThMsMsmRvbJ0g6Xlxa1agFCNeuXUPpB3sRwYtNOorGrVBRxNhlRjrmDfI6elAayffI0XwnWoBZlDUqM0tiL8pqbWNC9jo0Hv1RZTu+PoPEiRVYUvkFrl696qW08nMkjV+JvYd/wJUrV1DXdBzJE1ZSJlIjixy1lLyKKNJjZJmiBejMsmRuRFpoLUqEtShFy+s1pSCyb06dRfnWJhXZlNc04tDJn3Dp0iUvJRW70GPUK2SpVxglPLIEUSMWw8VTCzALInNbpXPTNmorpYXLUbJ6t4r9hcLly5dVZJ82ra2tSlFZFSWLKSy1pIvgEjFP94iFcA9faArwbaXMzjc/mZvMK+nRUhw6/r1XanOr0KalpQUHvjuFlJHz4KLENXwBXMMWwO1lPnkZ7syXTAEqs7YyUhhtlsQsymuIZNWJI+fg4LEztwlF5k9zczMOHKF82Cy4MuZaMpJphNEZ88hcRKfPRQxPLSCSErMoPEe/ambmtyguzjGKlSePKMGBo6dvEzc3G/HFixex/8hJpGbOhHvoC4jOnGfIMLKYjDmISX8RsSRmaImiBfiWhAsj89JFKeX8BJnZYtNKVp88fBYlJ1RoS4ULFy5g37cnkJpRDPeQWUz4osoUFhNLmTJkNs/ZiON3Ygc/bwrwyZZYSyLCRSqVRXEP95sbL0vJfFZlIrXZd/g4eqbPQPTg5zSZvyyWMhHGURjHf48ncYOeRTzRAmQrZVF8MksoM1OkjXYr5yCal6VStrV+L86fP4+Gxv3oOXQ6YgYWq0ySxQ0xsrjBM42MZ/ygYsQPfMYwYAYSBky3ChAJ0yneRZmnc4tON3OLSX/BoOmYipe60woR9dAkuPsUIFYuVZkRxg0UWTES+LlgC+P7T+M5DYn9nyYeU4BspHdRKNQlUZkgLTRtNK2UZFYrKYrlxXEisdMNEKGRJYhMERnpN5UUEQ8S+3qQkGYVEN9vPttqLwoX5A5zUySZNTu7jYbpmkrpb6czsiTFg6S+hRZTkJRWgKTeeUZuP/Hp/G8xyBbN9M1OZb7ZJVitvFnmS3eTME1kQj6S+uQjWclDcu9c3Ncv++YC7EclIrTS+ctMK6ciQdtYpG0UvOlUVoBkChWR9clFitB7MlIezqE8G/F/JP+/nt8BtAqhBo4bw/AAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792616610484,"unified_at":"2026-10-21T21:03:30.484Z","metadata":{"hashes":{"sha256":"021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","sha1":"b9b68c22bf62cc41d6001a1f1e14e0d05602b131","md5":"a42e8880650ec3fd4997823b44853b9c","sha512":"9903097e88d840b97b1a5428ca1dce9e706c3dc5390822392085003a12f757b03a7e751512ceff78afe5caf06cfc5b7887f07f875d26ff8e979b701e85645087","ssdeep":"196608:JG8ydWFQCooUohIjBXtUa2JHWTbRr+V4M64VD3DWUQvIDF3BQn0kWD/U2GmpZjWn:48ydWFEfBqB81yVZ64/Qc3BQ0kWI2Gd","ssdeep_chunks":["196608:JG8ydWF","196608:G8ydWFQ","196608:8ydWFQC","196608:ydWFQCo","196608:dWFQCoo","196608:WFQCooU","196608:FQCooUo","196608:QCooUoh","196608:CooUohI","196608:ooUohIj","196608:oUohIjB","196608:UohIjBX","196608:ohIjBXt","196608:hIjBXtU","196608:IjBXtUa","196608:jBXtUa2","196608:BXtUa2J","196608:XtUa2JH","196608:tUa2JHW","196608:Ua2JHWT","196608:a2JHWTb","196608:2JHWTbR","196608:JHWTbRr","196608:HWTbRr+","196608:WTbRr+V","196608:TbRr+V4","196608:bRr+V4M","196608:Rr+V4M6","196608:r+V4M64","196608:+V4M64V","196608:V4M64VD","196608:4M64VD3","196608:M64VD3D","196608:64VD3DW","196608:4VD3DWU","196608:VD3DWUQ","196608:D3DWUQv","196608:3DWUQvI","196608:DWUQvID","196608:WUQvIDF","196608:UQvIDF3","196608:QvIDF3B","196608:vIDF3BQ","196608:IDF3BQn","196608:DF3BQn0","196608:F3BQn0k","196608:3BQn0kW","196608:BQn0kWD","196608:Qn0kWD/","196608:n0kWD/U","196608:0kWD/U2","196608:kWD/U2G","196608:WD/U2Gm","196608:D/U2Gmp","196608:/U2GmpZ","196608:U2GmpZj","196608:2GmpZjW","196608:GmpZjWn","393216:JG8ydWF","393216:G8ydWFQ","393216:8ydWFQC","393216:ydWFQCo","393216:dWFQCoo","393216:WFQCooU","393216:FQCooUo","393216:QCooUoh","393216:CooUohI","393216:ooUohIj","393216:oUohIjB","393216:UohIjBX","393216:ohIjBXt","393216:hIjBXtU","393216:IjBXtUa","393216:jBXtUa2","393216:BXtUa2J","393216:XtUa2JH","393216:tUa2JHW","393216:Ua2JHWT","393216:a2JHWTb","393216:2JHWTbR","393216:JHWTbRr","393216:HWTbRr+","393216:WTbRr+V","393216:TbRr+V4","393216:bRr+V4M","393216:Rr+V4M6","393216:r+V4M64","393216:+V4M64V","393216:V4M64VD","393216:4M64VD3","393216:M64VD3D","393216:64VD3DW","393216:4VD3DWU","393216:VD3DWUQ","393216:D3DWUQv","393216:3DWUQvI","393216:DWUQvID","393216:WUQvIDF","393216:UQvIDF3","393216:QvIDF3B","393216:vIDF3BQ","393216:IDF3BQn","393216:DF3BQn0","393216:F3BQn0k","393216:3BQn0kW","393216:BQn0kWD","393216:Qn0kWD/","393216:n0kWD/U","393216:0kWD/U2","393216:kWD/U2G","393216:WD/U2Gm","393216:D/U2Gmp","393216:/U2GmpZ","393216:U2GmpZj","393216:2GmpZjW","393216:GmpZjWn","196608:48ydWFE","196608:8ydWFEf","196608:ydWFEfB","196608:dWFEfBq","196608:WFEfBqB","196608:FEfBqB8","196608:EfBqB81","196608:fBqB81y","196608:BqB81yV","196608:qB81yVZ","196608:B81yVZ6","196608:81yVZ64","196608:1yVZ64/","196608:yVZ64/Q","196608:VZ64/Qc","196608:Z64/Qc3","196608:64/Qc3B","196608:4/Qc3BQ","196608:/Qc3BQ0","196608:Qc3BQ0k","196608:c3BQ0kW","196608:3BQ0kWI","196608:BQ0kWI2","196608:Q0kWI2G","196608:0kWI2Gd"],"imphash":"57e98d9a5a72c8d7ad8fb7a6a58b3daf"},"file_info":{"file_name":"轰炸机器人客户端.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":12379934,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792612274000,"last_seen":1792612274000,"last_multi_scan":1792612274000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["plugx","evasive"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":99},"sandbox_signatures":{"informative_count":252,"suspicious_count":12,"malicious_count":4,"total":268},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CoinMiner.bot!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.MYX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.CoinMiner.bot","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to retrieve file and directory information"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Contains system command string that can search for a specific process"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Contains ability to retrieve remote session information"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"i@w9.pgl\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"sample.bin\"), Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\", Found registry query API: \"RegEnumValueA\" in \"sample.bin\", Found registry query API: \"RegEnumKeyA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/nsis_error\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownA\" (Indicator: \"InitiateShutdown\"; Source: \"sample.bin\"), Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"_.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\nsuD41.tmp\\ (UID: 00000000-00004288)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824-00000CC3-733487713\")\n Found reference to \"{Aes\" (Indicator: \"Aes\"; Source: \"00000000-00004288.00000001.152147.02560000.00000040.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.153519.07902000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.153519.07902000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.153519.07902000.00000004.mdmp, 00000000-00007824.00000001.153519.08519000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005176.00000000.152411.02590000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008980.00000000.152224.029C0000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\PhysicalDriveN; Source: \"64435-3226-00424B40\")\n Found string - \\\\.\\PhysicalDriveN; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found string - \\\\.\\ScsiN:; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 74430000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"_.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"_.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"tasklist.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2c","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"_.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007812-36445-143-00C2EF60\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007812-36445-211-00C2ED14\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007824-58821-43-0045B98C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007824-58821-154-0045BD00\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005176-64435-754-004A6ED9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005176-64435-755-004A6075\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005176-64435-1056-004D0BA0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005176-64435-1164-004B0442","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005176.00000000.152411.006A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2f","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"bcrypt::BCryptDecrypt(p R2, p r6, i R8, p 0, p R3, i 16, p r7, i 1048576, *i .R7, i R9) i .R6\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp\")\n Found reference to API \"bcrypt::BCryptDecrypt(p R2, p r6, i R8, p 0, p R3, i 16, p r7, i 1048576, *i .R7, i R9) i .R6\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004288.00000000.151415.009C0000.00000004.mdmp, 00000000-00004288.00000001.152147.009C0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005176.00000000.152411.006A0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007812.00000000.151581.02DF0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007824.00000000.152000.03140000.00000004.mdmp, 00000000-00007824.00000001.153519.03140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$31","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$32","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007824-00000C2C-721204010\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007824-00000C2C-723508860\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00007812.00000000.151581.02DF0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00007812.00000000.151581.02E16000.00000004.mdmp, 00000000-00007812.00000000.151581.02E30000.00000004.mdmp\")\n Found string \"vgauthservice.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00007812.00000000.151581.02E30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007824-00000C2C-721204010\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007824-00000C2C-723508860\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007824-00000C2C-719000753\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007824-00000C2C-719001437\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007824-00000C2C-726286181\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007824-00000C2C-726286214\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007824.00000001.153519.00462000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve file and directory information","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-726","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"_.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004288)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007824)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007824)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"_.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004288)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"_.exe\" called \"IsWow64Process\" with parameter \"4288\" - (UID: 00000000-00004288)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"7824\" - (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"_.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004288)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008704)\n \"tasklist.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007812)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003420)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002108)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"ev2c34.exe\" called \"OpenMutexW\" with parameter \"EMN:{68a2d59d-4a10-4edc-be73-a5bb2b5243d9} 1.0.001\" - (UID: 00000000-00005176)\n \"ev2c34.exe\" called \"OpenMutexW\" with parameter \"Tencent_QQpinyin_Hand_Input_JKR\" - (UID: 00000000-00005176)\n \"ev2c34.exe\" called \"OpenMutexA\" with parameter \"Local\\dXBsaW5l\" - (UID: 00000000-00005176)\n \"ev2c34.exe\" called \"OpenMutexA\" with parameter \"Local\\bG9jYWxndWFyZA\" - (UID: 00000000-00005176)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000654a00000200000000b119030000000080000000f867960718b1190300004103000000000000000068c3b802be60547780000000be6054770000000000000000800000009063347588c3b8028075477700004103000000008000000090633475020000002c2f3475a0c3b8029b63347501000000900435750200000000000000ccc3b8024b653475 (UID: 00000000-00007824)\n \"ev2c34.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005176)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"$35","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00007812-36445-334-00C2F185\n GetTickCount@KERNEL32.DLL at 00000000-00007824-58821-206-0045BF25\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-855-0050C330\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-1558-004DDFA0\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-1560-004DC060\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-1567-004DDCA0\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-1579-004DCCB0\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-1618-004DB330\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-1636-004DA350\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-1650-004DDD10\n GetTickCount@KERNEL32.DLL at 00000000-00008980-59893-2012-004BF880\n GetTickCount@KERNEL32.DLL at 00000000-00005176-64435-488-00401000\n GetTickCount@KERNEL32.DLL at 00000000-00005176-64435-2079-00486A20\n GetTickCount@KERNEL32.DLL at 00000000-00005176-64435-2087-00486640\n GetTickCount@KERNEL32.DLL at 00000000-00005176-64435-3383-004BA4F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"nsExec.dll\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007824.00000001.153519.00462000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00007824-58821-203-0045E07F\n FindFirstFileW@KERNEL32.DLL at 00000000-00008980-59893-1005-004FA3A0\n FindFirstFileW@KERNEL32.DLL at 00000000-00008980-59893-1053-004FAEB0\n FindFirstFileW@KERNEL32.DLL at 00000000-00008980-59893-1062-004FA530\n FindFirstFileW@KERNEL32.DLL at 00000000-00008980-59893-2072-004BB4E0\n FindFirstFileW@KERNEL32.DLL at 00000000-00005176-64435-2117-0043C2D0\n FindFirstFileW@KERNEL32.DLL at 00000000-00005176-64435-2232-0047A280\n FindNextFileW@KERNEL32.DLL at 00000000-00005176-64435-2263-00476AD0\n FindNextFileW@KERNEL32.DLL at 00000000-00005176-64435-2378-00477F10\n FindFirstFileW@KERNEL32.DLL at 00000000-00005176-64435-3195-00426E20\n FindFirstFileW@KERNEL32.DLL at 00000000-00005176-64435-3199-004A9384","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.DLL at 00000000-00008980-59893-2321-004A7023\n GetDriveTypeW@KERNEL32.DLL at 00000000-00005176-64435-3199-004A9384\n GetDriveTypeA@KERNEL32.DLL at 00000000-00005176-64435-3211-004C4CA5\n GetLogicalDrives@KERNEL32.DLL at 00000000-00005176-64435-3226-00424B40\n GetLogicalDrives@KERNEL32.DLL at 00000000-00005176-64435-3228-00424E20\n GetLogicalDrives@KERNEL32.DLL at 00000000-00005176-64435-3232-00425160\n GetLogicalDrives@KERNEL32.DLL at 00000000-00005176-64435-3233-00424820","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.DLL at 00000000-00007812-36445-220-00C28EB9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007812-36445-334-00C2F185\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007824-58821-206-0045BF25\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00008980-59893-1016-004FD6E0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-64435-908-004A624F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-64435-1696-004BCE6A\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00005176-64435-3199-004A9384\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-64435-3383-004BA4F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007812-36445-334-00C2F185\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007824-58821-206-0045BF25\n GetLocalTime@KERNEL32.DLL at 00000000-00008980-59893-226-00526CA0\n GetLocalTime@KERNEL32.DLL at 00000000-00008980-59893-231-005268D0\n GetLocalTime@KERNEL32.DLL at 00000000-00008980-59893-608-005178E0\n GetLocalTime@KERNEL32.DLL at 00000000-00005176-64435-488-00401000\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-64435-908-004A624F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-64435-1696-004BCE6A\n GetLocalTime@KERNEL32.DLL at 00000000-00005176-64435-3157-0042B090\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005176-64435-3383-004BA4F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005176-64435-2173-004B14D7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00007824-58821-106-0045F11D\n GetVersionExW@KERNEL32.DLL at 00000000-00005176-64435-3225-004254B0\n GetVersionExA@KERNEL32.DLL at 00000000-00005176-64435-3337-004A5797\n GetVersionExA@KERNEL32.DLL at 00000000-00005176-64435-4252-004AB4A9\n GetVersionExA@KERNEL32.DLL at 00000000-00005176-64435-4693-004A5667","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$36","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$37","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00007824-58821-100-0045F5DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$39","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"$3a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"tasklist.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call EnumServicesStatusExW@ADVAPI32.DLL directly followed by \"cmp eax, 01h\" and \"je 00C26424h\" at 00000000-00007812-36445-275-00C2632B\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, edi\" and \"je 004B16F3h\" at 00000000-00005176-64435-2173-004B14D7\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [esp+14h], 02h\" and \"jne 00425547h\" at 00000000-00005176-64435-3225-004254B0\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"jne 004A57D8h\" at 00000000-00005176-64435-3337-004A5797\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-10h], 02h\" and \"jne 004A56CBh\" at 00000000-00005176-64435-4693-004A5667","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSUD41.TMP\\NSEXEC.DLL\n %TEMP%\\NSUD41.TMP\\SYSTEM.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"_.exe\" queried token user identity (UID: 00000000-00004288)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ev2f79.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ev2c34.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"ev2c34.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EV2C34.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"nsExec.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp, 00000000-00005176.00000000.152411.02590000.00000040.mdmp, 00000000-00005176.00000000.152411.1001B000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005176.00000000.152411.02590000.00000040.mdmp, 00000000-00005176.00000000.152411.1001B000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007824.00000001.153519.00462000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"ev2c34.exe\" called \"CopyFileA\" to copy %APPDATA%\\comain_ev2c34\\bnymir.ou to new location %APPDATA%\\bnymir.ou (UID: 00000000-00005176)\n \"ev2c34.exe\" called \"CopyFileA\" to copy %APPDATA%\\comain_ev2c34\\ap.asin to new location %APPDATA%\\ap.asin (UID: 00000000-00005176)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"_.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\ (UID: 00000000-00004288)\n \"_.exe\" called \"CreateDirectoryA\" with parameter C:\\Users (UID: 00000000-00004288)\n \"_.exe\" called \"CreateDirectoryA\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004288)\n \"_.exe\" called \"CreateDirectoryA\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00004288)\n \"_.exe\" called \"CreateDirectoryA\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00004288)\n \"_.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00004288)\n \"_.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\nsuD41.tmp (UID: 00000000-00004288)\n \"_.exe\" called \"CreateDirectoryA\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004288)\n \"_.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\comain_ev2f79 (UID: 00000000-00004288)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3d","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"_.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004288)\n \"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00008704)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134370859884054620.7824.DefaultAppDomain.powershell\" - (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"tasklist.pdb\"\n \"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$40","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$41","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00007812-36445-330-00C22201\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007824-58821-83-0045FCA0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007824-58821-100-0045F5DC\n LoadLibraryExW@KERNEL32.DLL at 00000000-00007824-58821-105-0045F3BE\n LoadLibraryW@KERNEL32.DLL at 00000000-00008980-59893-1069-004F8BA0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00008980-59893-2125-004B5F00\n LoadLibraryExW@KERNEL32.DLL at 00000000-00008980-59893-2132-004B2140\n LoadLibraryExW@KERNEL32.DLL at 00000000-00008980-59893-2160-004B5180\n LoadLibraryExW@KERNEL32.DLL at 00000000-00008980-59893-2162-004B63B0\n LoadLibraryExW@KERNEL32.DLL at 00000000-00008980-59893-2177-004B2D10\n LoadLibraryExW@KERNEL32.DLL at 00000000-00008980-59893-2224-004AF560\n LoadLibraryA@KERNEL32.DLL at 00000000-00008980-59893-2414-004AB678\n LoadLibraryA@KERNEL32.DLL at 00000000-00008980-59893-2622-004AB4DB\n LoadLibraryA@KERNEL32.DLL at 00000000-00005176-64435-761-004C1B38\n CoLoadLibrary at 00000000-00005176-64435-1701-0049A0F0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00004288-00000C46-3274954192\")\n Found string \"cmd.exe /C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\\nD:\\\nF:\\\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00004288-00000C46-17311250482\")\n Found string \"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\\nD:\\\nF:\\\"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")\n Found string \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00004288.00000000.151415.009C0000.00000004.mdmp\")\n Found string \"md.exe /C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\\nD:\\\nF:\\\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00004288.00000001.152147.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00007824.00000001.153519.00462000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00007824.00000001.153519.00462000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$42","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Snipaste Installer.exe\" as clean (type is \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"), Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"), Antivirus vendors marked dropped file \"__PSScriptPolicyTest_30hlyxys.wz3.ps1\" as clean (type is \"ASCII text with no line terminators\"), Antivirus vendors marked dropped file \"__PSScriptPolicyTest_dadhufbk.vrl.ps1\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\" (UID: 00000000-00007824)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\".exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Snipaste Installer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134370859884054620.7824.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$45","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$46","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\ef4992f14ba62dc115c01e7a6018e263\\mscorlib.ni.dll\" at 727C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 74200000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 75120000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"_.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75BB0000\n \"_.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76FB0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75BB0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75BB0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76FB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75BB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76FB0000\n \"ev2f79.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75BB0000\n \"ev2c34.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 75BB0000\n \"ev2c34.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76FB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73CF0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"_.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76440000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76440000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76440000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76440000\n \"ev2f79.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76440000\n \"ev2c34.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76440000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"15001500022602100000000000001f76@ADVAPI32.dll\"\n \"140014001a2602100000000000001f76@ADVAPI32.dll\"\n \"12001200322602100000000000001f76@ADVAPI32.dll\"\n \"15001500482602100000000000001f76@ADVAPI32.dll\"\n \"10001000602602100000000000001f76@ADVAPI32.dll\"\n \"0e000e00742602100000000000001f76@ADVAPI32.dll\"\n \"0c000c00862602100000000000001f76@ADVAPI32.dll\"\n \"13001300962602100000000000001f76@ADVAPI32.dll\"\n \"14001400ac2602100000000000001f76@ADVAPI32.dll\"\n \"0d000d00c42602100000000000001f76@ADVAPI32.dll\"\n \"10001000540b02100000000000005d75@SHELL32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$47","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$48","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Tencentdl.exe\" (Indicator: \"tencent\") in Source: 64435-1795-00495D40","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00004288-00000BC0-709599803]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\tasklist.exe\" [Source: 00000000-00008704-00000BC0-710261383]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\findstr.exe\" [Source: 00000000-00008704-00000BC0-710426490]\n Observed system executable string:\"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00008704-00000C47-877569418]\n Observed system executable string:\"%WINDIR%\\system32\\findstr.exe\" [Source: 00000000-00008704-00000C47-1278172102]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00003420-00000C47-907813802]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002108-00000BC0-716817354]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002108-00000C47-891831806]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00008704) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00008704) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"tasklist.exe\" (UID: 00000000-00007812) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00000000-00003420) was launched with missing environment variables: \"PROMPT\"\n Process \"cmd.exe\" (UID: 00000000-00002108) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"ev2f79.exe\" (UID: 00000000-00008980) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$49","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00008704)\n Spawned process \"tasklist.exe\" (UID: 00000000-00007812)\n Spawned process \"findstr.exe\" with commandline \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00008336)\n Spawned process \"cmd.exe\" with commandline \"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -Exclusio ...\" (UID: 00000000-00003420), Spawned process \"cmd.exe\" with commandline \"/C \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\"\" (UID: 00000000-00002108), Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\\nD:\\\\\nF:\\\\\" (UID: 00000000-00007824), Spawned process \"ev2f79.exe\" (UID: 00000000-00008980), Spawned process \"ev2c34.exe\" (UID: 00000000-00005176)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00008704)\n Spawned process \"tasklist.exe\" (UID: 00000000-00007812)\n Spawned process \"findstr.exe\" with commandline \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00008336)\n Spawned process \"cmd.exe\" with commandline \"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -Exclusio ...\" (UID: 00000000-00003420), Spawned process \"cmd.exe\" with commandline \"/C \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\"\" (UID: 00000000-00002108), Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\\nD:\\\\\nF:\\\\\" (UID: 00000000-00007824), Spawned process \"ev2f79.exe\" (UID: 00000000-00008980), Spawned process \"ev2c34.exe\" (UID: 00000000-00005176)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\".exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ev2f79.exe.nhpart_48f89964d4ab\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ev2c34.exe.nhpart_8200df9dbca5\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsExec.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"_.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nszC94.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00000000-00007812-36445-292-00C27150\n LookupAccountNameW@ADVAPI32.DLL at 00000000-00005176-64435-2387-00427690","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"tasklist.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nszC94.tmp\" has type \"data\" - Location: [%TEMP%\\nszC94.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsuD41.tmp\\System.dll]- [targetUID: 00000000-00007824]\n \"nsExec.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsuD41.tmp\\nsExec.dll]- [targetUID: 00000000-00004288]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"_.exe\" queries basic process information of the \"C:\\_.exe\" (UID: 4288)\n \"_.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 4288)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"_.exe\" reads file \"c:\\_.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4e","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"_.exe\" trying to touch file \"C:\\Windows\\System32\\wow64log.dll\"\n \"_.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"_.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\IMM32.DLL\"\n \"_.exe\" trying to touch file \"\\Device\\KsecDD\"\n \"_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleaut32.dll\"\n \"_.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\oleaut32.dll\"\n \"_.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"_.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL32.dll\"\n \"_.exe\" trying to touch file \"C:\\MSVCP140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"_.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"_.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WindowsPowerShell\\profile.ps1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WindowsPowerShell\\profile.ps1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"_.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\nh_48f89964d4ab.nhc\"\n \"_.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\nh_5629f3e0a1ed.nhc\"\n \"_.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\nh_71a9a329e4b4.nhc\"\n \"_.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\nh_fb26a3da266f.nhc\"\n \"_.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\nh_3209290f3a4e.nhc\"\n \"_.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\nh_8200df9dbca5.nhc\"\n \"_.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\nh_aba42f2cdfff.nhc\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"_.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nszc94.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"nsExec.dll\")\n file/memory contains long string with (Indicator: \"PeekNamedPipe\"; File: \"nsExec.dll\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00004288.00000000.151415.10002000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004288.00000000.151415.10002000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00007824.00000001.153519.07902000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00007824.00000001.153519.07902000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$51","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"ev2f79.exe.nhpart_48f89964d4ab\"\n YARA signature for AES encryption matched on process \"00000000-00008980\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"Snipaste Installer.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004288\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00005176.00000000.152411.02590000.00000040.mdmp, 00000000-00005176.00000000.152411.1001B000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00005176.00000000.152411.02590000.00000040.mdmp, 00000000-00005176.00000000.152411.1001B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity","description":"WTSFreeMemory@WTSAPI32.DLL at 00000000-00005176-64435-2387-00427690","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1021.001","relevance":5,"id":"stream-137","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information","description":"WTSQuerySessionInformationW@WTSAPI32.DLL at 00000000-00005176-64435-2387-00427690","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1018","relevance":5,"id":"stream-138","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE455CFEF78DA7BF299228895BD9D7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007812.00000000.151581.02DF0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE455CFE\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007812.00000000.151581.02E22000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEB110C9614DD586EF3E0509325D8A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007824.00000000.152000.03140000.00000004.mdmp, 00000000-00007824.00000001.153519.03140000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE455CFEF78DA7BF299228895BD9D7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007824.00000001.153519.07988000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007824.00000001.153519.08519000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007812.00000000.151581.02E16000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007824.00000000.152000.03140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"4369446,4376,3024,,RtlGetVersion,NTDLL.dll,\"00:39:36.390\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004288.00000001.152147.009C0000.00000004.mdmp\")\n Found reference to API \",RtlGetVersion,NTDLL.dll,\"00:39:34.625\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007824.00000000.152000.03140000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"ev2c34.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 705B0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"_.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsuD41.tmp (UID: 00000000-00004288)\n \"_.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsuD41.tmp\\nh_48f89964d4ab.nhc (UID: 00000000-00004288)\n \"_.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsuD41.tmp\\nh_5629f3e0a1ed.nhc (UID: 00000000-00004288)\n \"_.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsuD41.tmp\\nh_71a9a329e4b4.nhc (UID: 00000000-00004288)\n \"_.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsuD41.tmp\\nh_fb26a3da266f.nhc (UID: 00000000-00004288)\n \"_.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsuD41.tmp\\nh_3209290f3a4e.nhc (UID: 00000000-00004288)\n \"_.exe\" called \"FindFirstFileA\" with parameter %TEMP%\\nsuD41.tmp\\nh_8200df9dbca5.nhc (UID: 00000000-00004288)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"_.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ev2f79.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ev2f79.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"ev2c34.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ev2c34.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007824)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$55","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"00000000-00005176.00000000.152411.0041F000.00000080.mdmp\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"00000000-00005176.00000000.152411.0041F000.00000080.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00004288-00000C46-3274954192\")\n Found string \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00008704-00000C47-1278172102\")\n Found string \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"findstr \"; File: \"cmd.exe\")\n Found string \"exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00004288.00000000.151415.009C0000.00000004.mdmp\")\n Found string \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00004288.00000000.151415.009C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"NoMatchPassword=These passwords do not match. Please re-enter them.\" (Indicator: \"password\"; Source: \"00000000-00007824.00000001.153519.08519000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains system command string that can search for a specific process","description":"Observed string: \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" [Source: 00000000-00004288-00000C46-3274954192]\n Observed string: \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" [Source: cmd.exe]\n Observed string: \"exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" [Source: 00000000-00004288.00000000.151415.009C0000.00000004.mdmp]\n Observed string: \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" [Source: 00000000-00004288.00000000.151415.009C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":1,"id":"string-172","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"tasklist\"; File: \"cmd.exe\")\n Found string \"exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"tasklist\"; Source: \"00000000-00004288.00000000.151415.009C0000.00000004.mdmp\")\n Found string \"cmd.exe /C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (Indicator: \"tasklist\"; Source: \"00000000-00004288.00000000.151415.009C0000.00000004.mdmp\")\n Found string \"tasklist\" (Indicator: \"tasklist\"; Source: \"00000000-00007812.00000000.151581.00B40000.00000004.mdmp, 00000000-00007812.00000000.151581.02DF0000.00000004.mdmp, 00000000-00007812.00000000.151581.02E22000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00008336)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007812)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007824)\n \"ev2f79.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008980)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$57","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"_.exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"ev2f79.exe\" opened \"\\Device\\KsecDD\"\n \"ev2c34.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\" (UID: 00000000-00007824)","origin":"Monitored Target","mitre_attack_id":"T1685","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"_.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFTUSERADMIN\"; Key: \"SOURCE\"; Value: \"Snipaste Installer\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005176.00000000.152411.02590000.00000040.mdmp, 00000000-00005176.00000000.152411.1001B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsuD41.tmp\\System.dll]- [targetUID: 00000000-00007824]\n \"nsExec.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsuD41.tmp\\nsExec.dll]- [targetUID: 00000000-00004288]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"nszC94.tmp has high entropy\"\n \"nh_3209290f3a4e.nhc has high entropy\"\n \"dxyvnb.ti.nhpart_3209290f3a4e has high entropy\"\n \"nh_48f89964d4ab.nhc has high entropy\"\n \"nh_8200df9dbca5.nhc has high entropy\"\n \"nh_fb26a3da266f.nhc has high entropy\"\n \"yinma.vc.nhpart_fb26a3da266f has high entropy\"\n \"nh_1cdda6b5f709.nhc has high entropy\"\n \"nh_aba42f2cdfff.nhc has high entropy\"\n \"bnymir.ou.nhpart_aba42f2cdfff has high entropy\"\n \"nh_5629f3e0a1ed.nhc has high entropy\"\n \"nh_995a8954d15f.nhc has high entropy\"\n \"nh_71a9a329e4b4.nhc has high entropy\"\n \"nh_9c9d6820913a.nhc has high entropy\"\n \"fhkan.oi.nhpart_9c9d6820913a has high entropy\"\n \"nh_db6dd1863c61.nhc has high entropy\"\n \"ap.asin.nhpart_db6dd1863c61 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ev2f79.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ev2c34.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7824)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"00000000-00005176.00000000.152411.0041F000.00000080.mdmp\")\n Found string \"dbgHelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"00000000-00005176.00000000.152411.0041F000.00000080.mdmp\")\n Found string \"dbgHelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00005176.00000000.152411.004D2000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00007812.00000000.151581.00C32000.00000002.mdmp\")\n Found string \":\\WINDOWS\\System32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00007812.00000000.151581.02DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/27 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$5c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"_.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"_.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"_.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"_.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"_.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"_.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"_.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"ev2f79.exe.nhpart_48f89964d4ab\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections\"- Location: [%APPDATA%\\comain_ev2f79\\ev2f79.exe.nhpart_48f89964d4ab]- [targetUID: 00000000-00004288]\n \"Snipaste Installer.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Community\\Snipaste Installer.exe]- [targetUID: 00000000-00004288]\n \"ev2c34.exe.nhpart_8200df9dbca5\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections\"- Location: [%APPDATA%\\comain_ev2c34\\ev2c34.exe.nhpart_8200df9dbca5]- [targetUID: 00000000-00004288]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsuD41.tmp\\System.dll]- [targetUID: 00000000-00007824]\n \"nsExec.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsuD41.tmp\\nsExec.dll]- [targetUID: 00000000-00004288]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"_.exe\" wrote 6656 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\nsExec.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"_.exe\" wrote 11264 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuD41.tmp\\System.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00008980-59893-2096-004B8E10\n SystemParametersInfoW@USER32.DLL at 00000000-00008980-59893-2097-004B88D0\n SystemParametersInfoW@USER32.DLL at 00000000-00008980-59893-2157-004B7110\n SystemParametersInfoW@USER32.DLL at 00000000-00005176-64435-2926-0043CD10\n SystemParametersInfoW@USER32.DLL at 00000000-00005176-64435-2927-0043CB80\n SystemParametersInfoW@USER32.DLL at 00000000-00005176-64435-3089-00430010","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$5e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@NTDLL.DLL at 00000000-00007812-36445-268-00C24A62","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00007812)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"PlugXBootLDRCode\" classified process \"00000000-00005176\" as \"plugx\"\n YARA signature \"PlugXBootLDRCode\" classified process \"00000000-00008980\" as \"plugx\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"_.exe\" (UID: 00000000-00004288)\n Spawned process \"cmd.exe\" with commandline \"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00008704)\n Spawned process \"tasklist.exe\" (UID: 00000000-00007812)\n Spawned process \"findstr.exe\" with commandline \"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"\" (UID: 00000000-00008336)\n Spawned process \"cmd.exe\" with commandline \"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\\\\nD:\\\\\nF:\\\\\"\" (UID: 00000000-00003420)\n Spawned process \"cmd.exe\" with commandline \"/C \"powershell Add-MpPreference -ExclusionPath C:\\\\\nD:\\\\\nF:\\\\\"\" (UID: 00000000-00002108)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath C:\\\\,D:\\\\,F:\\\\\" (UID: 00000000-00007824)\n Spawned process \"ev2f79.exe\" (UID: 00000000-00008980)\n Spawned process \"ev2c34.exe\" (UID: 00000000-00005176)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]}],"incidents":[{"name":"Spyware","details_count":6,"details":[{"detail":"Hooks API calls"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]}],"intel_graph":{"map":{"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc":{"type":"File","value":"021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc"},"File:11b5df0751622bf585bf5f2aba6b458987ff0da4b65ba936620bf2c608ae73c8":{"type":"File","value":"11b5df0751622bf585bf5f2aba6b458987ff0da4b65ba936620bf2c608ae73c8"},"File:2569de837063874169f25b3732d95cbdf8b291e6d18f9d8ce43b641b89818a2c":{"type":"File","value":"2569de837063874169f25b3732d95cbdf8b291e6d18f9d8ce43b641b89818a2c"},"File:29fbb5abc68c1c3f912500670f2ceb41b4ba3a9bf6af9c9a681aedfa7eb8e279":{"type":"File","value":"29fbb5abc68c1c3f912500670f2ceb41b4ba3a9bf6af9c9a681aedfa7eb8e279"},"File:2f592516e42bdf4b48eb92eced833db8c43681d00874257ee6e53395104d0142":{"type":"File","value":"2f592516e42bdf4b48eb92eced833db8c43681d00874257ee6e53395104d0142"},"File:370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0":{"type":"File","value":"370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0"},"File:4bb4285fa6c897f8282bbeded6bf01bef914f9d37a05d88732075a19c4fcb142":{"type":"File","value":"4bb4285fa6c897f8282bbeded6bf01bef914f9d37a05d88732075a19c4fcb142"},"File:5427d1ffdbc7ecd5daf28c73a4402a831a713cc414d9b5a3d7684cc7a7933538":{"type":"File","value":"5427d1ffdbc7ecd5daf28c73a4402a831a713cc414d9b5a3d7684cc7a7933538"},"File:6311d46495b54c0bbb3b1ce2962eaeca90e5bc7fb49fadead9d3dac1a2a61fb0":{"type":"File","value":"6311d46495b54c0bbb3b1ce2962eaeca90e5bc7fb49fadead9d3dac1a2a61fb0"},"File:7e0ba182715ef32d83fbb787a48fff9ce0d36f5093bbe090e053fbb0ea0ef572":{"type":"File","value":"7e0ba182715ef32d83fbb787a48fff9ce0d36f5093bbe090e053fbb0ea0ef572"},"File:80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1":{"type":"File","value":"80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1"},"File:872b735a605274ec840af81117ed3885c9c61b80a3b0c4085f69920c51397bc6":{"type":"File","value":"872b735a605274ec840af81117ed3885c9c61b80a3b0c4085f69920c51397bc6"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:b4b3881fac7889e356623aa2babddd5dea9ecedcf9b2ede0792fd3326c3d83ca":{"type":"File","value":"b4b3881fac7889e356623aa2babddd5dea9ecedcf9b2ede0792fd3326c3d83ca"},"File:b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352":{"type":"File","value":"b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352"},"File:cb15a72658298b25c63232ec2547e6664fa10ce5abd9a935b3c2e63894336a62":{"type":"File","value":"cb15a72658298b25c63232ec2547e6664fa10ce5abd9a935b3c2e63894336a62"},"File:ccebaf4aa2647c86e4f568c0d2742723d6963be4309d3b9c2b6781913301dc99":{"type":"File","value":"ccebaf4aa2647c86e4f568c0d2742723d6963be4309d3b9c2b6781913301dc99"},"File:d50b4753fd94a5d80e3931356fb483ceee749e7421e61dd5aa698805a2d6ff3b":{"type":"File","value":"d50b4753fd94a5d80e3931356fb483ceee749e7421e61dd5aa698805a2d6ff3b"},"File:d70431fe84ca9362e194895817eb49419ab9b0585cfb64ebd3f934a391093c5e":{"type":"File","value":"d70431fe84ca9362e194895817eb49419ab9b0585cfb64ebd3f934a391093c5e"}},"chains":[{"id":"sandbox_files","root":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","edges":[{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:872b735a605274ec840af81117ed3885c9c61b80a3b0c4085f69920c51397bc6"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:2569de837063874169f25b3732d95cbdf8b291e6d18f9d8ce43b641b89818a2c"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:11b5df0751622bf585bf5f2aba6b458987ff0da4b65ba936620bf2c608ae73c8"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:ccebaf4aa2647c86e4f568c0d2742723d6963be4309d3b9c2b6781913301dc99"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:4bb4285fa6c897f8282bbeded6bf01bef914f9d37a05d88732075a19c4fcb142"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:29fbb5abc68c1c3f912500670f2ceb41b4ba3a9bf6af9c9a681aedfa7eb8e279"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:2f592516e42bdf4b48eb92eced833db8c43681d00874257ee6e53395104d0142"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:d50b4753fd94a5d80e3931356fb483ceee749e7421e61dd5aa698805a2d6ff3b"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:d70431fe84ca9362e194895817eb49419ab9b0585cfb64ebd3f934a391093c5e"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:6311d46495b54c0bbb3b1ce2962eaeca90e5bc7fb49fadead9d3dac1a2a61fb0"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:b4b3881fac7889e356623aa2babddd5dea9ecedcf9b2ede0792fd3326c3d83ca"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:5427d1ffdbc7ecd5daf28c73a4402a831a713cc414d9b5a3d7684cc7a7933538"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:7e0ba182715ef32d83fbb787a48fff9ce0d36f5093bbe090e053fbb0ea0ef572"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:cb15a72658298b25c63232ec2547e6664fa10ce5abd9a935b3c2e63894336a62"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":48,"imported_dlls_count":123,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":35,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["plugx","evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6ad917b0e47eb82fcb0d4986","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Agent.MYX.gen","submit_name":"轰炸机器人客户端.exe","analysis_start_time":"2026-10-21T19:51:15+00:00","indicators_count":{"informative":253,"suspicious":81,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}],"processes":[{"pid":4288,"ppid":0,"name":"_.exe","command_line":"","sha256":"021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc","normalized_path":"C:\\_.exe","uid":"00000000-00004288","icon":"$60"},{"pid":8704,"ppid":4288,"name":"cmd.exe","command_line":"/C tasklist | findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"","sha256":"36fffab256a48c6fb76a4d1199193195e7707e9019414ac87572c3dbc810bc6c","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004288","uid":"00000000-00008704"},{"pid":7812,"ppid":8704,"name":"tasklist.exe","command_line":"","sha256":"76eac7b5f53e0d58a98d5a6ddf9c97e19d1462ef65c0035d7798f89988b15ab4","normalized_path":"%WINDIR%\\SysWOW64\\tasklist.exe","parent_uid":"00000000-00008704","uid":"00000000-00007812"},{"pid":8336,"ppid":8704,"name":"findstr.exe","command_line":"findstr /I /C:\"360tray.exe\" /C:\"HipsTray.exe\"","sha256":"1900c48fdb1c2ddfa59c37ba86affa502d44af55f313d0d53fac60d9b96943b6","normalized_path":"%WINDIR%\\SysWOW64\\findstr.exe","parent_uid":"00000000-00008704","uid":"00000000-00008336"},{"pid":3420,"ppid":4288,"name":"cmd.exe","command_line":"/C start \"\" /B cmd.exe /C \"powershell Add-MpPreference -ExclusionPath C:\\,D:\\,F:\\\"","sha256":"36fffab256a48c6fb76a4d1199193195e7707e9019414ac87572c3dbc810bc6c","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004288","uid":"00000000-00003420"},{"pid":2108,"ppid":3420,"name":"cmd.exe","command_line":"/C \"powershell Add-MpPreference -ExclusionPath C:\\,D:\\,F:\\\"","sha256":"36fffab256a48c6fb76a4d1199193195e7707e9019414ac87572c3dbc810bc6c","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003420","uid":"00000000-00002108"},{"pid":7824,"ppid":2108,"name":"powershell.exe","command_line":"powershell Add-MpPreference -ExclusionPath C:\\,D:\\,F:\\","sha256":"870eda04ea71cc066ec907f005e1d05ce592f04799c60e600e2cb986dc85b5eb","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002108","uid":"00000000-00007824"},{"pid":8980,"ppid":4288,"name":"ev2f79.exe","command_line":"","sha256":"2569de837063874169f25b3732d95cbdf8b291e6d18f9d8ce43b641b89818a2c","normalized_path":"%APPDATA%\\comain_ev2f79\\ev2f79.exe","parent_uid":"00000000-00004288","uid":"00000000-00008980"},{"pid":5176,"ppid":4288,"name":"ev2c34.exe","command_line":"","sha256":"872b735a605274ec840af81117ed3885c9c61b80a3b0c4085f69920c51397bc6","normalized_path":"%APPDATA%\\comain_ev2c34\\ev2c34.exe","parent_uid":"00000000-00004288","uid":"00000000-00005176"}],"all_imported_dlls":["sechost.dll","rpcrt4.dll","version.dll","amsi.dll","Microsoft.BitLocker.Structures.dll","msvcp_win.dll","coml2.dll","SHCore.dll","gdi32full.dll","fltLib.dll","msvcp140.dll","kernel.appcore.dll","wintrust.dll","urlmon.dll","Microsoft.PowerShell.Commands.Utility.dll","secur32.dll","VxSSL32.dll","oleacc.dll","wininet.dll","windows.storage.dll","wldp.dll","atl.dll","rsaenh.dll","setupapi.dll","cryptbase.dll","ucrtbase_clr0400.dll","mi.dll","wow64win.dll","framedynos.dll","wbemprox.dll","System.Transactions.dll","4Jg8jJ58.dll","System.ni.dll","System.Data.dll","Microsoft.AppV.AppVClientPowerShell.dll","ws2_32.dll","mscoreei.dll","mscorlib.ni.dll","oleaut32.dll","propsys.dll","mpr.dll","vcruntime140_clr0400.dll","msimg32.dll","wow64.dll","userenv.dll","clr.dll","miutils.dll","srvcli.dll","ole32.dll","imm32.dll","shfolder.dll","dbghelp.dll","System.Management.Automation.dll","KernelBase.dll","profapi.dll","sspicli.dll","System.Core.ni.dll","psapi.dll","dwmapi.dll","IconCodecService.dll","iertutil.dll","user32.dll","pwrshsip.dll","System.DirectoryServices.dll","System.Configuration.ni.dll","comdlg32.dll","ucrtbase.dll","cryptsp.dll","Microsoft.PowerShell.Security.dll","ntdll.dll","wow64cpu.dll","apphelp.dll","crypt32.dll","System.Xml.ni.dll","System.Numerics.dll","normaliz.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","uxtheme.dll","msasn1.dll","msisip.dll","Microsoft.Management.Infrastructure.dll","virtdisk.dll","Microsoft.PowerShell.Commands.Management.dll","wtsapi32.dll","wkscli.dll","cfgmgr32.dll","AppxSip.dll","samcli.dll","msvcrt.dll","comctl32.dll","WindowsCodecs.dll","wmiutils.dll","clrjit.dll","dpapi.dll","win32u.dll","clbcatq.dll","netutils.dll","vcruntime140.dll","wbemcomn.dll","System.Configuration.Install.dll","ntmarta.dll","shell32.dll","bcryptprimitives.dll","fastprox.dll","wmidcom.dll","winsta.dll","OpcServices.dll","kernel32.dll","mscoree.dll","Microsoft.Management.Infrastructure.Native.dll","netapi32.dll","System.dll","gdi32.dll","bcrypt.dll","combase.dll","shlwapi.dll","wbemsvc.dll","gpapi.dll","Microsoft.AppV.AppvClientComConsumer.dll","advapi32.dll","Microsoft.PowerShell.ConsoleHost.dll","wshext.dll","System.Management.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ev2c34.exe.nhpart_8200df9dbca5","sha256":"872b735a605274ec840af81117ed3885c9c61b80a3b0c4085f69920c51397bc6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"ev2f79.exe.nhpart_48f89964d4ab","sha256":"2569de837063874169f25b3732d95cbdf8b291e6d18f9d8ce43b641b89818a2c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"nsExec.dll","sha256":"370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Snipaste Installer.exe","sha256":"11b5df0751622bf585bf5f2aba6b458987ff0da4b65ba936620bf2c608ae73c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"__PSScriptPolicyTest_30hlyxys.wz3.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"__PSScriptPolicyTest_dadhufbk.vrl.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"System.dll","sha256":"b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"local.stat","sha256":"ccebaf4aa2647c86e4f568c0d2742723d6963be4309d3b9c2b6781913301dc99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"ap.asin.nhpart_db6dd1863c61","sha256":"4bb4285fa6c897f8282bbeded6bf01bef914f9d37a05d88732075a19c4fcb142","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"bnymir.ou.nhpart_aba42f2cdfff","sha256":"80ea61aa50e8fc47f3db2b37eca7350b21a3aa8f957c7cf9490bb7c3757379e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"bteuns.pt.nhpart_1cdda6b5f709","sha256":"29fbb5abc68c1c3f912500670f2ceb41b4ba3a9bf6af9c9a681aedfa7eb8e279","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"cmrsk.ce.nhpart_995a8954d15f","sha256":"2f592516e42bdf4b48eb92eced833db8c43681d00874257ee6e53395104d0142","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"fhkan.oi.nhpart_9c9d6820913a","sha256":"d50b4753fd94a5d80e3931356fb483ceee749e7421e61dd5aa698805a2d6ff3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"dxyvnb.ti.nhpart_3209290f3a4e","sha256":"d70431fe84ca9362e194895817eb49419ab9b0585cfb64ebd3f934a391093c5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"ntrin.er.nhpart_5629f3e0a1ed","sha256":"6311d46495b54c0bbb3b1ce2962eaeca90e5bc7fb49fadead9d3dac1a2a61fb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"otrm.oi.nhpart_71a9a329e4b4","sha256":"b4b3881fac7889e356623aa2babddd5dea9ecedcf9b2ede0792fd3326c3d83ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"yinma.vc.nhpart_fb26a3da266f","sha256":"5427d1ffdbc7ecd5daf28c73a4402a831a713cc414d9b5a3d7684cc7a7933538","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"ModuleAnalysisCache","sha256":"7e0ba182715ef32d83fbb787a48fff9ce0d36f5093bbe090e053fbb0ea0ef572","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"StartupProfileData-NonInteractive","sha256":"cb15a72658298b25c63232ec2547e6664fa10ce5abd9a935b3c2e63894336a62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"__PSScriptPolicyTest_2wu5zgvw.bxs.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"__PSScriptPolicyTest_svuvjmkl.2ei.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nspC55.tmp","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nszC94.tmp","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nsuD41.tmp","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nsuD41.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%APPDATA%\\comain_ev2f79","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nsuD41.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nsuD41.tmp\\nh_48f89964d4ab.nhc","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%APPDATA%\\comain_ev2f79\\ev2f79.exe.nhpart_48f89964d4ab","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nsuD41.tmp\\nh_5629f3e0a1ed.nhc","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%APPDATA%\\comain_ev2f79\\ntrin.er.nhpart_5629f3e0a1ed","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nsuD41.tmp\\nh_71a9a329e4b4.nhc","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%APPDATA%\\comain_ev2f79\\otrm.oi.nhpart_71a9a329e4b4","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\nsuD41.tmp\\nh_fb26a3da266f.nhc","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_30hlyxys.wz3.ps1","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2wu5zgvw.bxs.psm1","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_dadhufbk.vrl.ps1","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_svuvjmkl.2ei.psm1","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\windowsz.txt","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%APPDATA%\\Tencent\\QQPinyin","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%APPDATA%\\Tencent\\QQPinyin\\local.stat","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%TEMP%\\uk_tmp.txt","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%APPDATA%\\bnymir.ou","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"path":"%APPDATA%\\ap.asin","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4288:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4288:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:4288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:4288:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Local\\SM0:4288:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Local\\SM0:4288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:8704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7812:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7812:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7812:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Local\\SM0:7812:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:7812:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:7812:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:8336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3420:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:3420:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:2108:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:7824:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Local\\SM0:7824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:7824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Local\\SM0:7824:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7824:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:8980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5176:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\EMN:{68a2d59d-4a10-4edc-be73-a5bb2b5243d9} 1.0.001","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Tencent_QQpinyin_Hand_Input_JKR","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Tencent_QQpinyin_Hand_Input_JKR","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:5176:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"Local\\SM0:5176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"EMN:{68a2d59d-4a10-4edc-be73-a5bb2b5243d9} 1.0.001","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"SM0:5176:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6ad917b0e47eb82fcb0d4986"}]}]}},"report_ids":{"sandbox_job_ids":["6ad917b0e47eb82fcb0d4986"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.CoinMiner.bot Sample 021fc7bfa60f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 021fc7bfa60f…. Malware family: Trojan.CoinMiner.bot. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.CoinMiner.bot Sample 021fc7bfa60f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 021fc7bfa60f…. Malware family: Trojan.CoinMiner.bot. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/021fc7bfa60f4045b2af9c421bb47a637260b51714b127d195c5e9c565e2dedc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.CoinMiner.bot Sample 021fc7bfa60f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 021fc7bfa60f…. Malware family: Trojan.CoinMiner.bot. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L61","11",{}]]